THE CRUNCH
The Git project has released new versions fixing six security vulnerabilities, including one that allows arbitrary code execution when recursively cloning a malicious repository. The fixes land in Git 2.56.1, with backports to the 2.50 through 2.55 maintenance series. The project recommends updating to 2.56.1 or the patched release for your maintenance series, and updating any applications that bundle their own copy of Git.
The most serious flaw involves an integer truncation in Git's index handling: an extremely long path could pass validation under one name but be written using a shorter one. An attacker could exploit this to replace a submodule's .git file with a symbolic link to a directory holding malicious configuration or hooks, leading to code execution during a recursive clone. Other issues include path traversal via a malicious server's advertised HEAD reference, stack corruption when stripping GPG signatures, out-of-bounds reads when applying binary patches, heap corruption during large merges, and filesystem access through fast-import streams.
The memory corruption flaws matter beyond local machines: the merge-related bug can affect applications and hosting services that merge untrusted content on behalf of users, and the signature-stripping bug can hit hosting services performing those merges. GitHub says it has deployed fixes across github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency, and that updates for GitHub Enterprise Server are available in versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4. Releases of GitHub Desktop and the GitHub Copilot app with patched versions of Git are being coordinated, and Codespaces and Actions will also receive patched versions.
If you cannot update immediately, the project advises cloning only from trusted servers, avoiding recursive clones of untrusted repositories, and steering clear of merging untrusted content, tags, binary patches or fast-import streams.