Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Dec 5, 2018 | Nov 23, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gitwebUpgrade git-allUpgrade git-emailUpgrade gitkUpgrade git-p4Upgrade gitUpgrade git-debuginfoUpgrade git-core-docUpgrade git-daemonUpgrade git-svnUpgrade git-coreUpgrade git-cvsUpgrade perl-Git-SVNUpgrade perl-GitUpgrade git-guiUpgrade git-subtree | Apr 27, 2020 | Nov 23, 2018 |
| Amazon_linux | — | Upgrade git | Dec 21, 2018 | Nov 23, 2018 |
| Debian | — | Upgrade git | Jul 30, 2024 | Nov 23, 2018 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Apr 12, 2019 | Nov 23, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.19.2-11.4.6.0.1.2.0 on Solaris 11.4Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3 | Feb 20, 2019 | Nov 23, 2018 |
| Suse | — | Upgrade git-cvsUpgrade git-emailUpgrade git-credential-gnome-keyringUpgrade git-guiUpgrade git-archUpgrade git-svnUpgrade git-p4Upgrade git-daemonUpgrade git-docUpgrade git-credential-libsecretUpgrade git-coreUpgrade gitUpgrade gitkUpgrade git-web | Dec 23, 2018 | Nov 23, 2018 |
| Ubuntu | — | Upgrade git | Dec 4, 2018 | Nov 23, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub