PT-2019-5025 · Git+5 · Git+5

Nicolas Joly · Published 2019-12-10 · Updated 2024-06-15 · CVE-2019-1349

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Git (affected versions not specified)

Description The vulnerability in the recursive submodule cloning component of the distributed version control system Git is related to an insufficient input validation mechanism. Exploitation of this issue may allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-3258

ALT-PU-2019-3259

BDU:2020-01658

CESA-2019_4356

CVE-2019-1349

DLA-2059-1

DSA-4581-1

MGASA-2019-0393

OPENSUSE-SU-2020:0123-1

OPENSUSE-SU-2020:0598-1

OPENSUSE-SU-2020_0123-1

OPENSUSE-SU-2020_0598-1

OPENSUSE-SU-2024:10786-1

OPENSUSE-SU-2024:10943-1

RHSA-2019:4356

RHSA-2019_4356

RHSA-2020:0002

RHSA-2020:0228

SUSE-SU-2019:3311-1

SUSE-SU-2020:0045-1

SUSE-SU-2020:1121-1

USN-4220-1

Affected Products

Alt Linux

Centos

Git

Red Hat

Suse

Ubuntu

References · 104

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3311-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-1349 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4220-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1352 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1351 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4220-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1350 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1349 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1348 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10786-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1387 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0393 · Vendor Advisory