CVE-2018-19486
CVE-2018-19486
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
CVSS 9.8 · Critical · EPSS 4.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
git Debian:12
- Affected ranges
- ECOSYSTEM: < 1:2.19.2-1
Update to 1:2.19.2-1
git Debian:13
- Affected ranges
- ECOSYSTEM: < 1:2.19.2-1
Update to 1:2.19.2-1
git Debian:14
- Affected ranges
- ECOSYSTEM: < 1:2.19.2-1
Update to 1:2.19.2-1
git Ubuntu:18.04:LTS
- Versions
- 1:2.14.1-1ubuntu4
- 1:2.15.1-1ubuntu2
- 1:2.17.0-1ubuntu1
- 1:2.17.1-1ubuntu0.1
- 1:2.17.1-1ubuntu0.3
- Affected ranges
- ECOSYSTEM: < 1:2.17.1-1ubuntu0.4
Update to 1:2.17.1-1ubuntu0.4
Original sources
- https://git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60
- http://www.securityfocus.com/bid/106020
- https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt
- http://www.securitytracker.com/id/1042166
- https://access.redhat.com/errata/RHSA-2018:3800
- https://usn.ubuntu.com/3829-1/
- https://security.gentoo.org/glsa/201904-13
- https://nvd.nist.gov/vuln/detail/CVE-2018-19486