CVE-2019-19604
CVE-2019-19604
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVSS 7.8 · High · EPSS 3.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md
- https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://www.debian.org/security/2019/dsa-4581
- http://www.openwall.com/lists/oss-security/2019/12/13/1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
- https://security.gentoo.org/glsa/202003-30
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19604