CVE-2019-1387

Published: Dec 18, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

Affected (11)

Products: Git Scm: Git

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Git Scm Git	From 2.14.0 to 2.14.6
Git Scm Git	From 2.15.0 to 2.15.4
Git Scm Git	From 2.16.0 to 2.16.6
Git Scm Git	From 2.17.0 to 2.17.3
Git Scm Git	From 2.18.0 to 2.18.2
Git Scm Git	From 2.19.0 to 2.19.3
Git Scm Git	From 2.20.0 to 2.20.2
Git Scm Git	From 2.22.0 to 2.22.2
Git Scm Git	Version 2.21.0
Git Scm Git	Version 2.23.0
Git Scm Git	Version 2.24.0

References (27)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html

Source: secure@microsoft.com

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html

Source: secure@microsoft.com

https://access.redhat.com/errata/RHSA-2019:4356

Source: secure@microsoft.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0002

Source: secure@microsoft.com

https://access.redhat.com/errata/RHSA-2020:0124

Source: secure@microsoft.com

https://access.redhat.com/errata/RHSA-2020:0228

Source: secure@microsoft.com

https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html

Source: secure@microsoft.com

https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html

Source: secure@microsoft.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/

Source: secure@microsoft.com

https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u

Source: secure@microsoft.com

https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

Source: secure@microsoft.com

https://security.gentoo.org/glsa/202003-30

Source: secure@microsoft.com

https://security.gentoo.org/glsa/202003-42

Source: secure@microsoft.com

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:4356

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0002

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2020:0124

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2020:0228

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u

Source: af854a3a-2127-422b-91ae-364da2661108

https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202003-30

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202003-42

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.