CVE-2019-1387

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.
References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
https://access.redhat.com/errata/RHSA-2019:4356 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0002
https://access.redhat.com/errata/RHSA-2020:0124
https://access.redhat.com/errata/RHSA-2020:0228
https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
https://security.gentoo.org/glsa/202003-30
https://security.gentoo.org/glsa/202003-42
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
https://access.redhat.com/errata/RHSA-2019:4356 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0002
https://access.redhat.com/errata/RHSA-2020:0124
https://access.redhat.com/errata/RHSA-2020:0228
https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
https://security.gentoo.org/glsa/202003-30
https://security.gentoo.org/glsa/202003-42
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.21.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.23.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.24.0:*:*:*:*:*:*:*

History

21 Nov 2024, 04:36

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html - () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html -
References () http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html - () http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html -
References () https://access.redhat.com/errata/RHSA-2019:4356 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4356 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2020:0002 - () https://access.redhat.com/errata/RHSA-2020:0002 -
References () https://access.redhat.com/errata/RHSA-2020:0124 - () https://access.redhat.com/errata/RHSA-2020:0124 -
References () https://access.redhat.com/errata/RHSA-2020:0228 - () https://access.redhat.com/errata/RHSA-2020:0228 -
References () https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html - () https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html -
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/ -
References () https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u - () https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u -
References () https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/ - () https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/ -
References () https://security.gentoo.org/glsa/202003-30 - () https://security.gentoo.org/glsa/202003-30 -
References () https://security.gentoo.org/glsa/202003-42 - () https://security.gentoo.org/glsa/202003-42 -

26 Jun 2024, 10:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html -

07 Nov 2023, 03:08

Type Values Removed Values Added
References
  • {'url': 'https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/', 'name': 'https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/', 'name': 'FEDORA-2019-1cec196e20', 'tags': [], 'refsource': 'FEDORA'}
  • {'url': 'https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u', 'name': 'https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/ -
  • () https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/ -
  • () https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u -

Information

Published : 2019-12-18 21:15

Updated : 2024-11-21 04:36


NVD link : CVE-2019-1387

Mitre link : CVE-2019-1387

CVE.ORG link : CVE-2019-1387


JSON object : View

Products Affected

git-scm

  • git