Git credential helper vulnerability announced (Update)
Learn more about the security vulnerabilities affecting Git 2.26.1 and older.
![](https://github.blog/wp-content/uploads/2019/09/security-1200-630.png?resize=1200%2C630)
A couple of days ago, Git released v2.26.1 to address a critical vulnerability in the credential helper mechanism. Today, the Git project is releasing another round of updates to address a related issue that’s present in v2.26.1 and older.
This vulnerability allows a malformed URL to create a credential pattern inside Git with some fields left blank. Many credential helpers interpret these blank values as an instruction to match any credential. This can result in leaking values from the underlying credential store to untrusted sources, sending the password stored for one server to another.
These updates address this new issue by not invoking the credential helper at all when the URL contains an un-representable value.
Note that not all credential helpers behave in a way that triggers the vulnerability. Git’s own store
and cache
helpers, along with the osxkeychain
helper, are known to be vulnerable. Git Credential Manager for Windows is known to be unaffected. Other helpers should be assumed to be affected.
Upgrade to the latest Git version
The most effective way to protect against this vulnerability is to upgrade to v2.26.2. If you can’t update your client immediately, reduce your risk by following the same guidelines we recommend for v2.26.1:
- Avoid running git clone with
--recurse-submodules
against untrusted repositories. - Avoid using the credential helper by only cloning publicly available repositories
GitHub has implemented additional steps on top of the ones we took to protect against the attacks discovered in v2.26.1. Specifically, that means:
- Malicious
.gitmodules
(including new variants discovered in v2.26.2) are blocked from being pushed to GitHub.com. - A new GitHub Desktop release is being prepared that prevents exploiting the new vulnerability.
- The next patch release of GitHub Enterprise Server backports the push-blocking changes we’re using on GitHub.com. Note that installations themselves are not vulnerable to this new attack.
Credit for finding these vulnerabilities goes to Carlo Arenas, as well as further analysis by Jonathan Nieder of Google.
Tags:
Written by
Related posts
![](https://github.blog/wp-content/uploads/2024/05/Collaboration-LightMode-3.png?resize=400%2C212)
How to build an open source metrics dashboard
How GitHub volunteers built an open source metrics dashboard for the World Health Organization and some best practices they picked up along the way.
![](https://github.blog/wp-content/uploads/2024/05/Collaboration-LightMode-2-1.png?resize=400%2C212)
Automating open source: How Ersilia distributes AI models to advance global health equity
Discover how the Ersilia Open Source Initiative accelerates drug discovery by using GitHub Actions to disseminate AI/ML models.
![Orange rectangle with the Git logo and white text overlaid, which reads "Git 2.46 is here!"](https://github.blog/wp-content/uploads/2024/07/git-246.png?resize=400%2C212)
Highlights from Git 2.46
Git 2.46 is here with new features like pseudo-merge bitmaps, more capable credential helpers, and a new git config command. Check out our coverage on some of the highlights here.