CVE-2019-1387: High severity git vulnerability

Q: What is the severity of CVE-2019-1387?

The severity of CVE-2019-1387 is high (8.8).

Q: How does the vulnerability CVE-2019-1387 affect Git?

The vulnerability CVE-2019-1387 affects Git versions before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6.

Q: What is the vulnerability CVE-2019-1387?

The vulnerability CVE-2019-1387 is caused by too-lax validation of submodule names in Git, allowing targeted attacks via remote code execution.

Q: How can I fix the vulnerability CVE-2019-1387?

To fix the vulnerability CVE-2019-1387, users should update Git to versions v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, or v2.14.6.

Q: Where can I find more information about the vulnerability CVE-2019-1387?

More information about the vulnerability CVE-2019-1387 can be found at the following references: [link1], [link2], [link3].

Published Dec 9, 2019

Updated

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

Other sources

Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

References:

https://kernel.googlesource.com/pub/scm/git/git/+/refs/tags/v2.24.1/Documentation/RelNotes/2.14.6.txt

— Red Hat

Affected Software

22 affected componentsFixes available

debian/git

1:2.20.1-2+deb10u31:2.20.1-2+deb10u81:2.30.2-1+deb11u21:2.39.2-1.11:2.42.0-1

redhat/git<2.24.1

2.24.1

redhat/git<2.23.1

2.23.1

redhat/git<2.21.1

2.21.1

redhat/git<2.20.2

2.20.2

redhat/git<2.19.3

2.19.3

redhat/git<2.18.2

2.18.2

redhat/git<2.17.3

2.17.3

redhat/git<2.16.6

2.16.6

redhat/git<2.15.4

2.15.4

redhat/git<2.14.6

2.14.6

git-scm Git>=2.14.0<2.14.6

git-scm Git>=2.15.0<2.15.4

git-scm Git>=2.16.0<2.16.6

git-scm Git>=2.17.0<2.17.3

git-scm Git>=2.18.0<2.18.2

git-scm Git>=2.19.0<2.19.3

git-scm Git>=2.20.0<2.20.2

git-scm Git>=2.22.0<2.22.2

git-scm Git=2.21.0

git-scm Git=2.23.0

git-scm Git=2.24.0

Event History

Dec 18, 2019

CVE Published

via MITRE·08:11 PM

Data Sourced

via MITRE·08:11 PM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-1387?

The severity of CVE-2019-1387 is high (8.8).

How does the vulnerability CVE-2019-1387 affect Git?