Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gitkUpgrade git-svnUpgrade git-coreUpgrade git-p4Upgrade git-emailUpgrade git-debuginfoUpgrade perl-Git-SVNUpgrade gitUpgrade git-cvsUpgrade git-gnome-keyringUpgrade git-allUpgrade git-core-docUpgrade gitwebUpgrade perl-GitUpgrade git-guiUpgrade git-daemon | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade git-p4Upgrade git-cvsUpgrade git-emailUpgrade emacs-git-elUpgrade git-gnome-keyringUpgrade git-allUpgrade git-instawebUpgrade gitUpgrade gitkUpgrade emacs-gitUpgrade perl-GitUpgrade git-debuginfoUpgrade git-svnUpgrade git-bzrUpgrade gitwebUpgrade perl-Git-SVNUpgrade git-daemonUpgrade git-guiUpgrade git-hg | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade emacs-gitUpgrade perl-Git-SVNUpgrade git-hgUpgrade git-bzrUpgrade git-gnome-keyringUpgrade git-cvsUpgrade git-p4Upgrade gitUpgrade git-svnUpgrade git-emailUpgrade gitkUpgrade git-guiUpgrade git-daemonUpgrade git-instawebUpgrade gitwebUpgrade perl-GitUpgrade emacs-git-elUpgrade git-all | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade git-svnUpgrade git-cvsUpgrade git-bzrUpgrade gitUpgrade git-emailUpgrade git-debuginfoUpgrade git-gnome-keyringUpgrade emacs-git-elUpgrade gitwebUpgrade git-allUpgrade perl-GitUpgrade git-guiUpgrade git-instawebUpgrade emacs-gitUpgrade git-p4Upgrade gitkUpgrade git-hgUpgrade perl-Git-SVNUpgrade git-daemon | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade git-docUpgrade libgit2-28Upgrade libgit2-develUpgrade git-coreUpgrade gitkUpgrade git-guiUpgrade git-p4Upgrade git-daemonUpgrade git-cvsUpgrade libgit2-26Upgrade libgit2-26-32bitUpgrade git-emailUpgrade gitUpgrade git-credential-libsecretUpgrade git-credential-gnome-keyringUpgrade git-webUpgrade git-archUpgrade git-svn | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub