9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.024 Low
EPSS
Percentile
89.6%
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if ‘.’ were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
CPE | Name | Operator | Version |
---|---|---|---|
git | eq | 2.5.0-r0 | |
git | eq | 1.6.4.2-r0 | |
git | eq | 1.6.5.3-r0 | |
git | eq | 1.7.9.5-r0 | |
git | eq | 1.6.1-r0 | |
git | eq | 1.8.3-r0 | |
git | eq | 1.8.5.1-r0 | |
git | eq | 1.6.0.4-r1 | |
git | eq | 1.8.3.2-r0 | |
git | eq | 2.13.0-r1 |
www.securityfocus.com/bid/106020
www.securitytracker.com/id/1042166
access.redhat.com/errata/RHSA-2018:3800
git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60
git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt
security.gentoo.org/glsa/201904-13
usn.ubuntu.com/3829-1/
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.024 Low
EPSS
Percentile
89.6%