Critical Git vulnerability allows RCE when cloning repositories with submodules (CVE-2024-32002) (www.helpnetsecurity.com)
from kid@sh.itjust.works to cybersecurity@sh.itjust.works on 17 May 2024 11:38
https://sh.itjust.works/post/19424777

#cybersecurity

threaded - newest

MajorHavoc@programming.dev on 17 May 2024 13:47 collapse

Yay! I have a better reason to hate submodules now, until it’s patched everywhere, at least.

Altreus@sh.itjust.works on 17 May 2024 15:32 collapse

Nice, came here to dunk on submodules, and find there’s no need.

MajorHavoc@programming.dev on 17 May 2024 19:04 collapse

Yeah. I wanted to like submodules, but submodules, to me, ended up feeling like one feature too many in git.

I mainly run into submodules that have been setup accidentally by cloning inside an existing clone. That situation is, of course, not great.

Even for the many reasonable use cases for submodules, I generally end up letting my actual package manager do the work, instead. I’m generally happier for it, since life tends to be simpler when my package manager of choice knows about any required libraries.

Altreus@sh.itjust.works on 18 May 2024 18:02 collapse

Agreed. Haven’t yet found a use case that isn’t better handled by either build tools or “don’t do that”