CVE-2019-1387

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.21.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.23.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.24.0:*:*:*:*:*:*:*

History

26 Jun 2024, 10:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html -

07 Nov 2023, 03:08

Type Values Removed Values Added
References
  • {'url': 'https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/', 'name': 'https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/', 'name': 'FEDORA-2019-1cec196e20', 'tags': [], 'refsource': 'FEDORA'}
  • {'url': 'https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u', 'name': 'https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/ -
  • () https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/ -
  • () https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u -

Information

Published : 2019-12-18 21:15

Updated : 2024-06-26 10:15


NVD link : CVE-2019-1387

Mitre link : CVE-2019-1387

CVE.ORG link : CVE-2019-1387


JSON object : View

Products Affected

git-scm

  • git