For those wondering about the analogous vulnerability in Mercurial, the patch notes are out for a fix:

http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_....

You'll need 3.2.3 to be secure.