Lucene search

[email protected]CVE-2019-19604

HistoryDec 11, 2019 - 12:15 a.m.

CVE-2019-19604

2019-12-1100:15:13

CWE-78

CWE-862

[email protected]

web.nvd.nist.gov

355

cve-2019-19604

git

arbitrary command execution

security

vulnerability

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.9%

JSON

Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a “git submodule update” operation can run commands found in the .gitmodules file of a malicious repository.

Affected configurations

NVD

Node

git-scmgitRange<2.20.0

git-scmgitRange2.21.0–2.21.1

git-scmgitRange2.22.0–2.22.2

git-scmgitRange2.23.0–2.23.1

git-scmgitRange2.24.0–2.24.1

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

fedoraprojectfedoraMatch30

fedoraprojectfedoraMatch31

Node

opensuseleapMatch15.1

CPENameOperatorVersion
git-scm:gitgit-scm gitlt2.20.0
git-scm:gitgit-scm gitlt2.21.1
git-scm:gitgit-scm gitlt2.22.2
git-scm:gitgit-scm gitlt2.23.1
git-scm:gitgit-scm gitlt2.24.1

CPE	Name	Operator	Version
git-scm:git	git-scm git	lt	2.20.0
git-scm:git	git-scm git	lt	2.21.1
git-scm:git	git-scm git	lt	2.22.2
git-scm:git	git-scm git	lt	2.23.1
git-scm:git	git-scm git	lt	2.24.1