Brew doesn't ever work to replace or patch an OS version - it's consciously designed to only put binaries beside those from Apple and not in place of.
If you want to make sure that no program calls Apple's
/usr/bin/git or you don't call it, then these steps will accomplish that goal of hardening your 10.11 installs:
- Run OS X Recovery by holding down Command-R while the Mac is starting up.
- Use the Utilities menu to run Terminal
- Enter single user mode by holding Command-S while the Mac is restarting.
mount -uw /
- rm /usr/bin/git
- Repeat the OS X Recovery step and open Terminal and run
At this point, the
git from Apple is removed.
Search for other
/Library/Developer/CommandLineTools/usr/bin/git is 2.5.4
/Applications/Xcode.app/Contents/Developer/usr/bin/git is 2.5.4
You are at very slight risk since you only ran without SIP in single user mode long enough to remove the one binary. You can also get git 2.7.4 from brew as of March 18, 2016 if you like:
brew install git
You'll want to watch all OS X updates to be sure they don't pop another copy of
git that's patched lower than you wish. For most people, I would focus on only connecting to servers that are patched and/or known to be not malicious. Just having the git sitting there is low risk in my read of the situation.
Some other threads of interest: