Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gitUpgrade git-coreUpgrade git-p4Upgrade git-cvsUpgrade git-gnome-keyringUpgrade git-svnUpgrade gitkUpgrade git-debuginfoUpgrade git-emailUpgrade perl-Git-SVNUpgrade git-core-docUpgrade git-allUpgrade gitwebUpgrade git-guiUpgrade git-daemonUpgrade perl-Git | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade gitkUpgrade git-emailUpgrade emacs-gitUpgrade git-p4Upgrade gitUpgrade git-cvsUpgrade git-instawebUpgrade git-gnome-keyringUpgrade perl-GitUpgrade git-debuginfoUpgrade git-allUpgrade emacs-git-elUpgrade git-hgUpgrade perl-Git-SVNUpgrade git-bzrUpgrade git-daemonUpgrade git-guiUpgrade gitwebUpgrade git-svn | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade emacs-git-elUpgrade git-instawebUpgrade gitwebUpgrade git-guiUpgrade git-daemonUpgrade perl-GitUpgrade git-allUpgrade gitkUpgrade git-hgUpgrade git-p4Upgrade emacs-gitUpgrade git-cvsUpgrade gitUpgrade perl-Git-SVNUpgrade git-emailUpgrade git-gnome-keyringUpgrade git-svnUpgrade git-bzr | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade gitkUpgrade git-instawebUpgrade git-p4Upgrade git-hgUpgrade emacs-gitUpgrade perl-Git-SVNUpgrade git-daemonUpgrade git-guiUpgrade git-cvsUpgrade perl-GitUpgrade git-svnUpgrade gitwebUpgrade git-gnome-keyringUpgrade emacs-git-elUpgrade gitUpgrade git-bzrUpgrade git-allUpgrade git-emailUpgrade git-debuginfo | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade libgit2-26-32bitUpgrade git-webUpgrade git-svnUpgrade libgit2-26Upgrade git-cvsUpgrade git-archUpgrade git-credential-libsecretUpgrade gitUpgrade git-credential-gnome-keyringUpgrade git-emailUpgrade git-p4Upgrade git-guiUpgrade git-docUpgrade libgit2-28Upgrade libgit2-develUpgrade git-daemonUpgrade gitkUpgrade git-core | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub