Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gitUpgrade git-svnUpgrade gitkUpgrade git-p4Upgrade perl-Git-SVNUpgrade git-coreUpgrade git-emailUpgrade git-cvsUpgrade git-gnome-keyringUpgrade git-debuginfoUpgrade git-core-docUpgrade git-allUpgrade git-daemonUpgrade git-guiUpgrade perl-GitUpgrade gitweb | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade git-hgUpgrade git-guiUpgrade perl-Git-SVNUpgrade git-bzrUpgrade git-svnUpgrade git-daemonUpgrade gitwebUpgrade git-cvsUpgrade git-instawebUpgrade git-gnome-keyringUpgrade git-emailUpgrade emacs-gitUpgrade git-p4Upgrade git-debuginfoUpgrade emacs-git-elUpgrade gitkUpgrade git-allUpgrade gitUpgrade perl-Git | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade emacs-git-elUpgrade git-allUpgrade git-instawebUpgrade git-daemonUpgrade gitwebUpgrade perl-GitUpgrade git-guiUpgrade git-gnome-keyringUpgrade git-bzrUpgrade git-cvsUpgrade git-emailUpgrade git-p4Upgrade git-hgUpgrade gitUpgrade perl-Git-SVNUpgrade gitkUpgrade emacs-gitUpgrade git-svn | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade gitwebUpgrade perl-GitUpgrade git-cvsUpgrade git-emailUpgrade git-svnUpgrade git-debuginfoUpgrade git-gnome-keyringUpgrade emacs-git-elUpgrade gitUpgrade git-allUpgrade git-bzrUpgrade git-p4Upgrade git-guiUpgrade git-instawebUpgrade git-hgUpgrade emacs-gitUpgrade git-daemonUpgrade perl-Git-SVNUpgrade gitk | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade git-docUpgrade gitkUpgrade git-p4Upgrade libgit2-28Upgrade git-daemonUpgrade libgit2-develUpgrade git-coreUpgrade git-guiUpgrade git-svnUpgrade git-archUpgrade libgit2-26Upgrade git-credential-gnome-keyringUpgrade git-cvsUpgrade git-credential-libsecretUpgrade gitUpgrade libgit2-26-32bitUpgrade git-webUpgrade git-email | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub