ByteOS Network

NVD Vulnerability Details :

CVE-2019-19604

Modified

Source-cve@mitre.org

Published At-11 Dec, 2019 | 00:15

Updated At-07 Nov, 2023 | 03:07

Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

git-scm>>git>>Versions before 2.20.0(exclusive)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

git-scm>>git>>Versions from 2.21.0(inclusive) to 2.21.1(exclusive)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

git-scm>>git>>Versions from 2.22.0(inclusive) to 2.22.2(exclusive)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

git-scm>>git>>Versions from 2.23.0(inclusive) to 2.23.1(exclusive)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

git-scm>>git>>Versions from 2.24.0(inclusive) to 2.24.1(exclusive)

cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>9.0

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>10.0

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Fedora Project

>>fedora>>30

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Fedora Project

>>fedora>>31

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

openSUSE

>>leap>>15.1

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov
CWE-862	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	cve@mitre.org	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	cve@mitre.org	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/12/13/1	cve@mitre.org	Mailing List Third Party Advisory
https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md	cve@mitre.org	Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/	cve@mitre.org	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/	cve@mitre.org	N/A
https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	cve@mitre.org	N/A
https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt	cve@mitre.org	Third Party Advisory
https://security.gentoo.org/glsa/202003-30	cve@mitre.org	Third Party Advisory
https://www.debian.org/security/2019/dsa-4581	cve@mitre.org	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History