CVE-2019-1387

2019-12-1820:11:53

microsoft

www.cve.org

AI Score

9.6

Confidence

High

EPSS

0.087

Percentile

94.6%

JSON

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

CNA Affected

[
  {
    "vendor": "Microsoft Corporation",
    "product": "Git",
    "versions": [
      {
        "version": "Before v2.24.1",
        "status": "affected"
      },
      {
        "version": "Before v2.23.1",
        "status": "affected"
      },
      {
        "version": "Before v2.22.2",
        "status": "affected"
      },
      {
        "version": "Before v2.21.1",
        "status": "affected"
      },
      {
        "version": "Before v2.20.2",
        "status": "affected"
      },
      {
        "version": "Before v2.19.3",
        "status": "affected"
      },
      {
        "version": "Before v2.18.2",
        "status": "affected"
      },
      {
        "version": "Before v2.17.3",
        "status": "affected"
      },
      {
        "version": "Before v2.16.6",
        "status": "affected"
      },
      {
        "version": "Before v2.15.4",
        "status": "affected"
      },
      {
        "version": "Before v2.14.6",
        "status": "affected"
      }
    ]
  }
]