Remediating the October 2018 Git Security Vulnerability
Oct 6, 2018Edward Thomson

Summary
This post addresses a security vulnerability in Git's recursive submodule cloning that could lead to arbitrary code execution. It clarifies that Git for Windows is not vulnerable due to filesystem restrictions. Visual Studio and Visual Studio Code are also not directly impacted, but users are encouraged to upgrade their system's Git client. Azure Repos will prevent the push of malicious Git repositories as a mitigation.
More from the NTLM Removal in Git (libcurl) for Azure DevOps Server trail
- Upcoming Change: NTLM Removal in Git (libcurl) – Impact to Azure DevOps Server Customers
- End of Support for Microsoft products reliant on older Azure DevOps and Visual Studio authentication
- End of SSH-RSA support for Azure Repos
- August patches for Azure DevOps Server
- Reconfigure Azure DevOps Server to use Kerberos instead of NTLM