Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade git-daemonUpgrade perl-GitUpgrade git-guiUpgrade git-core-docUpgrade git-allUpgrade gitwebUpgrade git-svnUpgrade gitkUpgrade git-debuginfoUpgrade git-emailUpgrade git-gnome-keyringUpgrade perl-Git-SVNUpgrade git-coreUpgrade git-cvsUpgrade gitUpgrade git-p4 | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade gitkUpgrade git-cvsUpgrade git-allUpgrade git-debuginfoUpgrade git-gnome-keyringUpgrade emacs-git-elUpgrade git-emailUpgrade git-p4Upgrade emacs-gitUpgrade git-instawebUpgrade gitUpgrade perl-GitUpgrade git-hgUpgrade git-bzrUpgrade git-daemonUpgrade gitwebUpgrade git-guiUpgrade perl-Git-SVNUpgrade git-svn | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade git-instawebUpgrade perl-GitUpgrade gitwebUpgrade git-guiUpgrade git-daemonUpgrade emacs-git-elUpgrade git-allUpgrade git-hgUpgrade git-p4Upgrade perl-Git-SVNUpgrade git-gnome-keyringUpgrade gitkUpgrade git-bzrUpgrade gitUpgrade emacs-gitUpgrade git-emailUpgrade git-svnUpgrade git-cvs | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade emacs-git-elUpgrade git-debuginfoUpgrade git-svnUpgrade gitwebUpgrade git-bzrUpgrade perl-GitUpgrade gitUpgrade git-cvsUpgrade git-allUpgrade git-emailUpgrade git-gnome-keyringUpgrade gitkUpgrade git-guiUpgrade git-instawebUpgrade perl-Git-SVNUpgrade git-daemonUpgrade git-p4Upgrade git-hgUpgrade emacs-git | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade git-guiUpgrade git-p4Upgrade git-daemonUpgrade git-coreUpgrade libgit2-28Upgrade libgit2-develUpgrade gitkUpgrade git-docUpgrade git-credential-libsecretUpgrade git-webUpgrade git-svnUpgrade git-cvsUpgrade libgit2-26Upgrade libgit2-26-32bitUpgrade gitUpgrade git-emailUpgrade git-credential-gnome-keyringUpgrade git-arch | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub