CVE-2019-1387

CVE-2019-1387 affects Git prior to the fix in 2.24.1, due to too-lax validation of submodule names during recursive clones. This could allow remote code execution when cloning a repository with submodules. Public advisories note the vulnerability and cite fixes in Git versions 2.24.1 and later; s...

CVE-2019-19604

Git before 2.24.1 is vulnerable to arbitrary command execution via recursive submodule updates because a malicious .gitmodules can cause commands to be run. Affected ranges include 2.20.2, 2.21.x, 2.22.x, 2.23.x, and 2.24.x prior to 2.24.1. Remediation: upgrade to Git 2.24.1 or later (UPC/ALAS re...