Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade git-allUpgrade gitwebUpgrade git-core-docUpgrade perl-GitUpgrade git-daemonUpgrade git-guiUpgrade git-svnUpgrade git-emailUpgrade git-debuginfoUpgrade perl-Git-SVNUpgrade git-cvsUpgrade gitkUpgrade git-coreUpgrade gitUpgrade git-p4Upgrade git-gnome-keyring | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade emacs-git-elUpgrade git-emailUpgrade git-allUpgrade gitkUpgrade git-debuginfoUpgrade gitUpgrade emacs-gitUpgrade git-cvsUpgrade perl-GitUpgrade git-gnome-keyringUpgrade git-p4Upgrade git-instawebUpgrade git-daemonUpgrade git-svnUpgrade git-hgUpgrade git-bzrUpgrade perl-Git-SVNUpgrade git-guiUpgrade gitweb | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade git-guiUpgrade gitwebUpgrade git-allUpgrade git-daemonUpgrade emacs-git-elUpgrade perl-GitUpgrade git-instawebUpgrade git-hgUpgrade git-emailUpgrade git-p4Upgrade git-svnUpgrade git-cvsUpgrade git-bzrUpgrade emacs-gitUpgrade perl-Git-SVNUpgrade gitUpgrade gitkUpgrade git-gnome-keyring | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade git-p4Upgrade git-instawebUpgrade gitkUpgrade git-guiUpgrade emacs-gitUpgrade git-daemonUpgrade git-hgUpgrade perl-Git-SVNUpgrade git-allUpgrade gitwebUpgrade perl-GitUpgrade git-gnome-keyringUpgrade git-debuginfoUpgrade git-emailUpgrade git-svnUpgrade git-bzrUpgrade gitUpgrade git-cvsUpgrade emacs-git-el | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade git-docUpgrade git-daemonUpgrade git-p4Upgrade libgit2-develUpgrade libgit2-28Upgrade gitkUpgrade git-guiUpgrade git-coreUpgrade git-webUpgrade git-credential-libsecretUpgrade libgit2-26-32bitUpgrade git-credential-gnome-keyringUpgrade libgit2-26Upgrade git-svnUpgrade git-emailUpgrade gitUpgrade git-archUpgrade git-cvs | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub