ALT-PU-2019-3276-1
Closed vulnerabilities
BDU:2020-01458
Уязвимость системы управления версиями GIT, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2020-01655
Уязвимость компонента проверки имени подмодулей распределенной системы управления версиями Git, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании и оказать воздействие на целостность данных
BDU:2020-01656
Уязвимость компонента безопасности подсистемы запуска WSL распределенной системы управления версиями Git, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании и оказать воздействие на целостность данных
BDU:2020-01657
Уязвимость компонента работы с NTFS Alternate Data Streams распределенной системы управления версиями Git, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании и оказать воздействие на целостность данных
BDU:2020-01658
Уязвимость компонента рекурсивного клонирования подмодулей распределенной системы управления версиями Git, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании и оказать воздействие на целостность данных
BDU:2020-01659
Уязвимость опции быстрого импорта --export-marks распределенной системы управления версиями Git, позволяющая нарушителю вызвать отказ в обслуживании и оказать воздействие на целостность данных
Modified: 2024-11-21
CVE-2019-1348
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- RHSA-2020:0228
- RHSA-2020:0228
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
- GLSA-202003-42
- GLSA-202003-42
- https://support.apple.com/kb/HT210729
- https://support.apple.com/kb/HT210729
Modified: 2024-11-21
CVE-2019-1349
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- RHSA-2020:0228
- RHSA-2020:0228
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
Modified: 2024-11-21
CVE-2019-1350
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
- GLSA-202003-42
- GLSA-202003-42
Modified: 2024-11-21
CVE-2019-1351
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
Modified: 2024-11-21
CVE-2019-1352
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- RHSA-2020:0228
- RHSA-2020:0228
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
Modified: 2024-11-21
CVE-2019-1353
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
Modified: 2024-11-21
CVE-2019-1354
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
Modified: 2024-11-21
CVE-2019-1387
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- RHSA-2019:4356
- RHSA-2019:4356
- RHSA-2020:0002
- RHSA-2020:0002
- RHSA-2020:0124
- RHSA-2020:0124
- RHSA-2020:0228
- RHSA-2020:0228
- [debian-lts-announce] 20200123 [SECURITY] [DLA 2059-1] git security update
- [debian-lts-announce] 20200123 [SECURITY] [DLA 2059-1] git security update
- [debian-lts-announce] 20240626 [SECURITY] [DLA 3844-1] git security update
- [debian-lts-announce] 20240626 [SECURITY] [DLA 3844-1] git security update
- FEDORA-2019-1cec196e20
- FEDORA-2019-1cec196e20
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- GLSA-202003-30
- GLSA-202003-30
- GLSA-202003-42
- GLSA-202003-42
Modified: 2024-11-21
CVE-2019-19604
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0123
- openSUSE-SU-2020:0598
- openSUSE-SU-2020:0598
- [oss-security] 20191213 Multiple vulnerabilities fixed in Git
- [oss-security] 20191213 Multiple vulnerabilities fixed in Git
- https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md
- https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md
- FEDORA-2019-c841bcc3b9
- FEDORA-2019-c841bcc3b9
- FEDORA-2019-1cec196e20
- FEDORA-2019-1cec196e20
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt
- https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt
- GLSA-202003-30
- GLSA-202003-30
- DSA-4581
- DSA-4581
Closed bugs
git completion location
git не подхватывает git-subtree из пакета git-contrib