CVE-2019-1387

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 4.4%

probabilidad de explotación

4.4%top 10% de las CVE

explotación observada

noninguna fuente lo reporta

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

Productos afectados

Microsoft Corporation · Git

Referencias

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html https://access.redhat.com/errata/RHSA-2019:4356 https://access.redhat.com/errata/RHSA-2020:0002 https://access.redhat.com/errata/RHSA-2020:0124 https://access.redhat.com/errata/RHSA-2020:0228 https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/