Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gitkUpgrade perl-Git-SVNUpgrade gitUpgrade git-coreUpgrade git-cvsUpgrade git-gnome-keyringUpgrade git-svnUpgrade git-debuginfoUpgrade git-p4Upgrade git-emailUpgrade git-guiUpgrade gitwebUpgrade git-daemonUpgrade git-core-docUpgrade perl-GitUpgrade git-all | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade git-emailUpgrade git-allUpgrade gitUpgrade emacs-git-elUpgrade git-debuginfoUpgrade perl-GitUpgrade gitkUpgrade git-instawebUpgrade git-cvsUpgrade git-p4Upgrade git-gnome-keyringUpgrade emacs-gitUpgrade git-bzrUpgrade git-svnUpgrade git-daemonUpgrade git-guiUpgrade gitwebUpgrade git-hgUpgrade perl-Git-SVN | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade gitUpgrade gitkUpgrade git-bzrUpgrade emacs-gitUpgrade git-p4Upgrade git-emailUpgrade perl-Git-SVNUpgrade git-cvsUpgrade git-hgUpgrade git-gnome-keyringUpgrade git-svnUpgrade gitwebUpgrade git-instawebUpgrade git-allUpgrade perl-GitUpgrade emacs-git-elUpgrade git-daemonUpgrade git-gui | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade git-emailUpgrade git-cvsUpgrade git-allUpgrade emacs-git-elUpgrade gitUpgrade git-bzrUpgrade git-gnome-keyringUpgrade gitwebUpgrade git-svnUpgrade git-debuginfoUpgrade perl-GitUpgrade gitkUpgrade git-guiUpgrade git-hgUpgrade perl-Git-SVNUpgrade emacs-gitUpgrade git-instawebUpgrade git-daemonUpgrade git-p4 | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade git-credential-libsecretUpgrade git-webUpgrade libgit2-26-32bitUpgrade git-cvsUpgrade git-emailUpgrade gitUpgrade git-credential-gnome-keyringUpgrade libgit2-26Upgrade git-svnUpgrade git-archUpgrade gitkUpgrade git-p4Upgrade git-coreUpgrade git-daemonUpgrade libgit2-28Upgrade libgit2-develUpgrade git-docUpgrade git-gui | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub