Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade git | Oct 26, 2018 | Oct 6, 2018 |
| Amazon Linux Ami 2 | — | Upgrade git-guiUpgrade perl-GitUpgrade git-allUpgrade git-core-docUpgrade gitwebUpgrade git-daemonUpgrade git-cvsUpgrade git-coreUpgrade gitUpgrade git-debuginfoUpgrade git-emailUpgrade perl-Git-SVNUpgrade git-gnome-keyringUpgrade git-svnUpgrade gitkUpgrade git-p4 | Apr 27, 2020 | Oct 6, 2018 |
| Amazon_linux | — | Upgrade git | Oct 19, 2018 | Oct 5, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 6, 2018 |
| Centos_linux | — | Upgrade git-instawebUpgrade git-allUpgrade git-p4Upgrade gitkUpgrade git-cvsUpgrade gitUpgrade emacs-gitUpgrade git-gnome-keyringUpgrade perl-GitUpgrade git-emailUpgrade emacs-git-elUpgrade git-debuginfoUpgrade git-daemonUpgrade git-bzrUpgrade git-svnUpgrade gitwebUpgrade git-guiUpgrade perl-Git-SVNUpgrade git-hg | Dec 15, 2018 | Oct 5, 2018 |
| Debian | — | Upgrade git | Oct 6, 2018 | Oct 5, 2018 |
| Freebsd | — | Upgrade libgit2 | Oct 16, 2018 | Oct 15, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade git | Dec 4, 2019 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade git | Dec 11, 2018 | Oct 6, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade git | May 1, 2019 | Oct 6, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/git to version 2.19.2-0.175.3.36.0.11.0 on Solaris 11.3Upgrade developer/versioning/git to version 2.15.3-11.4.3.0.1.4.0 on Solaris 11.4 | Nov 19, 2018 | Oct 6, 2018 |
| Oracle_linux | — | Upgrade git-p4Upgrade git-emailUpgrade git-hgUpgrade git-gnome-keyringUpgrade git-svnUpgrade git-cvsUpgrade gitUpgrade gitkUpgrade perl-Git-SVNUpgrade emacs-gitUpgrade git-bzrUpgrade gitwebUpgrade perl-GitUpgrade git-allUpgrade git-daemonUpgrade git-instawebUpgrade emacs-git-elUpgrade git-gui | Feb 4, 2020 | Oct 5, 2018 |
| Redhat_linux | — | Upgrade git-daemonUpgrade git-p4Upgrade perl-Git-SVNUpgrade git-hgUpgrade emacs-gitUpgrade git-guiUpgrade git-instawebUpgrade gitkUpgrade git-cvsUpgrade git-gnome-keyringUpgrade emacs-git-elUpgrade git-allUpgrade gitUpgrade git-emailUpgrade git-svnUpgrade gitwebUpgrade git-debuginfoUpgrade git-bzrUpgrade perl-Git | Oct 31, 2018 | Oct 6, 2018 |
| Suse | — | Upgrade gitkUpgrade git-guiUpgrade git-daemonUpgrade git-coreUpgrade git-p4Upgrade libgit2-develUpgrade libgit2-28Upgrade git-docUpgrade git-svnUpgrade git-credential-gnome-keyringUpgrade gitUpgrade git-credential-libsecretUpgrade git-webUpgrade git-emailUpgrade libgit2-26-32bitUpgrade libgit2-26Upgrade git-archUpgrade git-cvs | Oct 13, 2018 | Oct 5, 2018 |
| Ubuntu | — | Upgrade git | Oct 23, 2018 | Oct 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub