CVE-2019-1387

Description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

8.8

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 2.79% Top 15%

Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory fedoraproject.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory gentoo.org Vendor Advisory opensuse.org

Affected: Microsoft Corporation Git

References

Link	Tags
https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
https://access.redhat.com/errata/RHSA-2019:4356	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2020:0002	vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/	vendor advisory
https://access.redhat.com/errata/RHSA-2020:0124	vendor advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html	mailing list
https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor advisory
https://access.redhat.com/errata/RHSA-2020:0228	vendor advisory
https://security.gentoo.org/glsa/202003-30	vendor advisory
https://security.gentoo.org/glsa/202003-42	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html	mailing list

Frequently Asked Questions

What is the severity of CVE-2019-1387?: CVE-2019-1387 has been scored as a high severity vulnerability.
How to fix CVE-2019-1387?: To fix CVE-2019-1387, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-1387 being actively exploited in the wild?: It is possible that CVE-2019-1387 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-1387?: CVE-2019-1387 affects Microsoft Corporation Git.