CVE-2019-1387
Publication date 10 December 2019
Last updated 25 August 2025
Ubuntu priority
Description
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| git | ||
| 18.04 LTS bionic |
Fixed 1:2.17.1-1ubuntu0.5
|
|
| 16.04 LTS xenial |
Fixed 1:2.7.4-0ubuntu1.7
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.8 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-4220-1
- Git vulnerabilities
- 10 December 2019