VulnSocial

CVE-2018-11235Patch(canonical / debian_linux)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch canonical debian_linux systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

canonical CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • debian_linux
  • enterprise_linux
  • enterprise_linux_desktop
  • enterprise_linux_server

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 1 signal
  • Peaked 2d ago at 1 mentions (2026-09-05); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
canonicaldebiangit-scmgitforwindowsredhat
Products
debian_linuxenterprise_linuxenterprise_linux_desktopenterprise_linux_serverenterprise_linux_server_eusenterprise_linux_workstationgitubuntu_linux

9 versions affected across 8 products

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-05: 1Mentions · 2026-09-07: 1Mentions · 2026-09-08: 1Patch / Workaround · 2026-09-05: 1Patch / Workaround · 2026-09-07: 1Patch / Workaround · 2026-09-08: 1Technical Details · 2026-09-05: 109-0509-0709-08
Signal classification1 categories
Patch
3100.0%
Referenced assets1 URL
By indicator
Full discourse3 posts
  • PCMedicalist@PCMedicalist
    Patch

    PCMedicalist Signal · Sep 08 CVE-2018-11235--Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta: patch Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta and verify the fix held. PCMedicalist · https://pcmedicalist.com/intel https://t.co/jaTQCGHcwg

    Post summary

    The post announces that CVE-2018-11235, affecting Kubernetes v1.37 Kubelet in user namespace (rootless mode), has received a patch and is now considered fixed, although detailed technical or exploitation information is not provided.

    0001035
    151 followersView on X
  • PCMedicalist@PCMedicalist
    Patch

    PCMedicalist Signal · Sep 07 CVE-2018-11235--Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta: patch Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta and verify the fix held. PCMedicalist · https://pcmedicalist.com/intel https://t.co/vS8F4CbB51

    Post summary

    The tweet announces that CVE-2018-11235 has been patched in Kubernetes v1.37, with the fix validated and the feature "KubeletInUserNamespace" moved to Beta.

    0000030
    152 followersView on X
  • PCMedicalist@PCMedicalist
    Patch

    PCMedicalist Signal · Sep 05 CVE-2018-11235--Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta: patch Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta and verify the fix held. PCMedicalist · https://pcmedicalist.com/intel https://t.co/c2UhDY2WHc

    Post summary

    The tweet announces that Kubernetes v1.37’s patch for CVE-2018-11235 (KubeletInUserNamespace rootless mode) has been applied and verified, indicating a vulnerability fix.

    0000037
    152 followersView on X
CPE platform detail14 entries

14 of 14 entries

PartVendorProductVersionTarget SWTarget HW
OScanonicalubuntu_linux14.04--
OScanonicalubuntu_linux16.04--
OScanonicalubuntu_linux17.10--
OScanonicalubuntu_linux18.04--
OSdebiandebian_linux8.0--
OSdebiandebian_linux9.0--
Appgit-scmgit---
Appgit-scmgit2.17.0--
Appgitforwindowsgit---
OSredhatenterprise_linux7.0--
OSredhatenterprise_linux_desktop7.0--
OSredhatenterprise_linux_server7.0--
OSredhatenterprise_linux_server_eus7.5--
OSredhatenterprise_linux_workstation7.0--

Explore more

Back to dashboardcanonical CVEsdebian CVEsgit-scm CVEsdebian_linux vulnerabilities