Developer Briefing — March 17, 2020

Executive briefing: On 17 March 2020, the Git project released version 2.25.2 and security backports to address CVE-2020-5260 and CVE-2020-5267. The issues allowed credential leakage when using partial clone over HTTPS and permitted crafted submodules to bypass directory traversal protections on case-insensitive file systems.

Why it matters: Exploitation can disclose developer credentials or write files outside intended working trees during submodule operations, enabling supply-chain compromise. Client upgrades and tightened URL validation are required to protect CI/CD runners and developer workstations.

• Upgrade clients: Roll out Git 2.25.2+ (or vendor backports) to developer machines and CI images; rebuild containers to pick up patched binaries.
• Restrict clones: Disable partial clone over HTTPS for sensitive repositories until patched and enforce insteadOf URL mappings to trusted endpoints.
• Validate submodules: Audit submodule URLs in manifests and block untrusted repositories; enforce safe.directory settings in CI to mitigate path confusion.
• Credential hygiene: Rotate credentials used by automated jobs that performed partial clones over HTTPS prior to patching.