Be notified of new releases
Create your free GitHub account today to subscribe to this repository for new releases and build software alongside 28 million developers.Sign up
This is a security release fixing insufficient validation of submodule names (CVE-2018-11235, reported by Etienne Stalmans).
While submodule names come from the untrusted ".gitmodules" file, we blindly append the name to $GIT_DIR/modules to construct the final path of the submodule repository. In case the name contains e.g. ../, an adversary would be able to escape your repository and write data at arbitrary paths. In accordance with git, we now enforce some rules for submodule names which will cause libgit2 to ignore these malicious names.
libgit2 is not susceptible to CVE-2018-11233.