Git clone vulnerability announced
Today, the Git project released new versions to address CVE-2021-21300: a security vulnerability in the delayed checkout mechanism used by Git LFS during git clone operations affecting versions 2.15 and…
![](https://github.blog/wp-content/uploads/2019/09/security-1200-630.png?resize=1200%2C630)
Today, the Git project released new versions to address CVE-2021-21300: a security vulnerability in the delayed checkout mechanism used by Git LFS during git clone
operations affecting versions 2.15 and newer.
These updates address an issue where a specially crafted repository can execute code during a git clone
on case-insensitive filesystems which support symbolic links by abusing certain types of clean/smudge filters, like those configured by Git LFS.
Upgrade to the latest Git version
The most effective way to protect against this vulnerability is to upgrade to 2.30.2. If you can’t update immediately, you can reduce your risk by doing any of the following:
- Disable support for symbolic links in Git by running
git config
.
--global core.symlinks false - Disable support for process filters. (You can see if any of these are configured on your system by running
git config
1)
--show-scope --get-regexp 'filter\..*\.process' - Avoid cloning untrusted repositories.
GitHub itself is not vulnerable to this attack. We do not store checked out copies of repositories on our servers, except for GitHub Pages, which does not use any clean/smudge filters.
Credit for finding and fixing this vulnerability is shared among Matheus Tavares and Johannes Schindelin.
1. In the Windows Command Prompt, replace the single quotes in this example with double quotes.
Tags:
Written by
Related posts
![](https://github.blog/wp-content/uploads/2024/05/Collaboration-LightMode-3.png?resize=400%2C212)
How to build an open source metrics dashboard
How GitHub volunteers built an open source metrics dashboard for the World Health Organization and some best practices they picked up along the way.
![](https://github.blog/wp-content/uploads/2024/05/Collaboration-LightMode-2-1.png?resize=400%2C212)
Automating open source: How Ersilia distributes AI models to advance global health equity
Discover how the Ersilia Open Source Initiative accelerates drug discovery by using GitHub Actions to disseminate AI/ML models.
![Orange rectangle with the Git logo and white text overlaid, which reads "Git 2.46 is here!"](https://github.blog/wp-content/uploads/2024/07/git-246.png?resize=400%2C212)
Highlights from Git 2.46
Git 2.46 is here with new features like pseudo-merge bitmaps, more capable credential helpers, and a new git config command. Check out our coverage on some of the highlights here.