Corrective releases for the distributed version control system Git 2.30.2, 2.17.6, 2.18.5, 2.19.6, 2.20.5, 2.21.4, 2.22.5, 2.23.4, 2.24.4, 2.25.5, 2.26.3, 2.27.1, 2.28.1, and 2.29.3 have been published, which address the vulnerability (CVE-2021-21300) that allows for remote code execution when cloning an attacker's repository using the command 'git clone'. All Git releases from version 2.15 are vulnerable.
The issue manifests when using deferred checkout operations applied in some cleanup filters, such as those configured in Git LFS. Exploitation of the vulnerability is possible only in case-sensitive file systems that support symbolic links, such as NTFS, HFS+, and APFS (i.e., on Windows and macOS platforms).
As a workaround for protection, you can disable symbolic link handling in Git by executing 'git config --global core.symlinks false', or disable filter process support using the command 'git config --show-scope --get-regexp 'filter\..*\.process'. It is also recommended to avoid cloning unverified repositories.
Source: opennet.ru
