BUG GIT, (CVE-2018-11233 and CVE-2018-11235)

GIT update vulnerability CVE-2018-11233 and CVE-2018-11235

Vulnerable GIT: 
before 2.17.1,
GIT GIT 2.17 
before 2.16.4,
GIT GIT 2.16.3 
GIT GIT 2.16 
before 2.15.2
GIT GIT 2.15.1 
GIT GIT 2.15 
before 2.14.4
GIT GIT 2.14.3 
GIT GIT 2.14.2 
GIT GIT 2.14.1 
GIT GIT 2.14 
before 2.13.7
GIT GIT 2.13.6 
GIT GIT 2.13.5 
GIT GIT 2.13.4 
GIT GIT 2.13.3 
GIT GIT 2.13.2 
GIT GIT 2.13.1 
GIT GIT 2.13 

Not Vulnerable GIT: 
GIT GIT 2.17.1 
GIT GIT 2.16.4 
GIT GIT 2.15.2 
GIT GIT 2.14.4 
GIT GIT 2.13.7 

check git vulnerable CVE-2018-11233 and CVE-2018-11235
git init test && \
  cd test && \
  git update-index --add --cacheinfo 120000,e69de29bb2d1d6434b8b29ae775ad8c2e48c5391,.gitmodules

If you see:
Initialized empty Git repository in /root/test/.git/

this vulnerable


If you see:
error: Invalid path '.gitmodules'
fatal: git update-index: --cacheinfo cannot add .gitmodules

Congratulations - you are already running a version of Git that is not vulnerable.
#######################################################################
if your computer is vulnerable, you can do this
update git via apt. 
apt-get update && apt-get install git-core

and return to test this vulnerable
if stil vulnerable, do step below

this step is for GIT source 2.13.7,
#######################################################################
# check Git version
git --version

# Remove packaged Git
sudo apt-get remove git-core

# Install dependencies
apt-get update && sudo apt-get install -y libcurl4-openssl-dev libexpat1-dev gettext libz-dev libssl-dev build-essential

# Download and compile from source
cd /tmp
curl --remote-name --progress https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.13.7.tar.gz
echo 'd9ac54f87d2877e0a92fad8c76657e3801726b29c2cc2dda8aca46cd28756504  git-2.13.7.tar.gz' | shasum -a256 -c - && tar -xzf git-2.13.7.tar.gz
cd git-2.13.7/
./configure
make prefix=/usr/local all

# Install into /usr/local/bin
sudo make prefix=/usr/local install

# check again
git --version

Ref:
https://threatpost.com/bug-in-git-opens-developer-systems-up-to-attack/132395/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235
https://www.edwardthomson.com/blog/upgrading_git_for_cve2018_11235.html
https://www.securityfocus.com/bid/104345



one step install from source
sudo apt-get remove git-core && \
apt-get update && sudo apt-get install -y libcurl4-openssl-dev libexpat1-dev gettext libz-dev libssl-dev build-essential && \
cd /tmp && curl --remote-name --progress https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.13.7.tar.gz && \
echo 'd9ac54f87d2877e0a92fad8c76657e3801726b29c2cc2dda8aca46cd28756504  git-2.13.7.tar.gz' | shasum -a256 -c - && tar -xzf git-2.13.7.tar.gz && \
cd git-2.13.7/ && ./configure &&  make prefix=/usr/local all && sudo make prefix=/usr/local install