CVE-2019-19604

Name
CVE-2019-19604
Description
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt
Exploit https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md
Mailing List https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
Third Party Advisory https://www.debian.org/security/2019/dsa-4581
Mailing List http://www.openwall.com/lists/oss-security/2019/12/13/1
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
GENTOO https://security.gentoo.org/glsa/202003-30
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= None < 2.20.0
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.21.0 < 2.21.1
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.22.0 < 2.22.2
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.23.0 < 2.23.1
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* git >= 2.24.0 < 2.24.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
git edge-main 2.24.1-r0 None fixed
git edge-main 2.19.1-r0 None possibly vulnerable
git edge-main 2.17.1-r0 None possibly vulnerable
git edge-main 2.14.1-r0 None possibly vulnerable
git 3.22-main 2.24.1-r0 None fixed
git 3.22-main 2.19.1-r0 None possibly vulnerable
git 3.22-main 2.17.1-r0 None possibly vulnerable
git 3.22-main 2.14.1-r0 None possibly vulnerable
git 3.21-main 2.24.1-r0 None fixed
git 3.21-main 2.19.1-r0 None possibly vulnerable
git 3.21-main 2.17.1-r0 None possibly vulnerable
git 3.21-main 2.14.1-r0 None possibly vulnerable
git 3.20-main 2.24.1-r0 None fixed
git 3.20-main 2.19.1-r0 None possibly vulnerable
git 3.20-main 2.17.1-r0 None possibly vulnerable
git 3.20-main 2.14.1-r0 None possibly vulnerable
git 3.19-main 2.24.1-r0 None fixed
git 3.19-main 2.19.1-r0 None possibly vulnerable
git 3.19-main 2.17.1-r0 None possibly vulnerable
git 3.19-main 2.14.1-r0 None possibly vulnerable
git 3.18-main 2.24.1-r0 None fixed
git 3.17-main 2.24.1-r0 None fixed
git 3.12-main 2.24.1-r0 None fixed
git 3.11-main 2.24.1-r0 None fixed
git 3.10-main 2.22.2-r0 None fixed