p PatchFirst

CVE-2019-1387

CVE-2019-1387

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

CVSS 8.8 · High · EPSS 4.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • git

    Versions
    • Before v2.24.1: Affected
    • Before v2.23.1: Affected
    • Before v2.22.2: Affected
    • Before v2.21.1: Affected
    • Before v2.20.2: Affected
    • Before v2.19.3: Affected
    • Before v2.18.2: Affected
    • Before v2.17.3: Affected
    • Before v2.16.6: Affected
    • Before v2.15.4: Affected
    • Before v2.14.6: Affected

    No fix published

  • git Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:2.24.0-2

    Update to 1:2.24.0-2

  • git Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:2.24.0-2

    Update to 1:2.24.0-2

  • git Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:2.24.0-2

    Update to 1:2.24.0-2

  • git Ubuntu:16.04:LTS

    Versions
    • 1:2.5.0-1
    • 1:2.6.2-1
    • 1:2.6.3-1
    • 1:2.6.4-1
    • 1:2.7.0~rc3-1
    • 1:2.7.0-1
    • 1:2.7.3-0ubuntu1
    • 1:2.7.4-0ubuntu1
    • 1:2.7.4-0ubuntu1.1
    • 1:2.7.4-0ubuntu1.2
    • 1:2.7.4-0ubuntu1.3
    • 1:2.7.4-0ubuntu1.4
    • 1:2.7.4-0ubuntu1.5
    • 1:2.7.4-0ubuntu1.6
    Affected ranges
    • ECOSYSTEM: < 1:2.7.4-0ubuntu1.7

    Update to 1:2.7.4-0ubuntu1.7

  • git Ubuntu:18.04:LTS

    Versions
    • 1:2.14.1-1ubuntu4
    • 1:2.15.1-1ubuntu2
    • 1:2.17.0-1ubuntu1
    • 1:2.17.1-1ubuntu0.1
    • 1:2.17.1-1ubuntu0.3
    • 1:2.17.1-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 1:2.17.1-1ubuntu0.5

    Update to 1:2.17.1-1ubuntu0.5

Original sources

Check your server →