Amazon Linux AMI update for git

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU21082

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13486

Exploit availability: No

Description

The vulnerability allows a remote attacker to access or modify data, or cause a denial of service (DoS) condition on an affected system.

The vulnerability exists in the status-log viewer component due to a boundary error in the "svcstatus.c" file because the software does not properly validate user-supplied input. A remote unauthenticated attacker can submit malicious input, trigger stack-based buffer overflow and access or modify data, or cause a DoS condition on the affected system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stack-based buffer overflow

EUVDB-ID: #VU21060

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13485

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a long hostname or service parameter in history.c within the in the history viewer component. A remote authenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU23494

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1349

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper validation of integrity check value

EUVDB-ID: #VU22542

Risk: High

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-13496

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the affected software does not validate or incorrectly validates the integrity check values. A remote attacker can perform a man-in-the-middle (MitM) attack, bypass OTP, replace a failed SAML response with a successful SAML response and gain access to the application.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU22528

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-13498

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to the affected software does not use HTTP Strict Transport Security (HSTS). A remote attacker can perform perform a man-in-the-middle attack, steal credentials and manipulate content.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Cross-site request forgery

EUVDB-ID: #VU22527

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13497

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in logout requests. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU23493

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1350

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU19390

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13509

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a local attacker to access sensitive information on a targeted system.

The vulnerability exists due to the software can add secrets to the debug log when the "docker stack deploy" command is used while running in debug mode to redeploy a stack which includes non-external secrets. A local authenticated attacker can gain access to sensitive information, such as secrets in the log files on a targeted system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Stored cross-site scripting

EUVDB-ID: #VU19241

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13505

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks via the E-mail field.

The vulnerability exists due to insufficient sanitization of user-supplied data in a booking form. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds read

EUVDB-ID: #VU19220

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-13504

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to an out-of-bounds read error in the "Exiv2::MrwImage::readMetadata" function in the "mrwimage.cpp" file. A remote attacker can create a specially crafted media file, trick the victim into opening it and cause the affected application to crash.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

12) Absolute Path Traversal

EUVDB-ID: #VU23500

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1351

CWE-ID: CWE-36 - Absolute Path Traversal

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to the Git for Visual Studio improperly handles virtual drive paths. A remote attacker can clone a file using a specially crafted path and write arbitrary files and directories to certain locations on a vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Type Confusion

EUVDB-ID: #VU21331

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13519

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing the .DOE files. A remote attacker can trick a victim to open a specially crafted .DOE file, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Session Fixation

EUVDB-ID: #VU20897

Risk: Low

CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13517

CWE-ID: CWE-384 - Session Fixation

Exploit availability: No

Description

The vulnerability allows a local attacker to steal authenticated sessions.

The vulnerability exists due to the exists access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an Active Directory (AD) domain. A local authenticated user can use the AD credentials of a previously authenticated user to gain access to the device and obtain the patient data and medication.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Stack-based buffer overflow

EUVDB-ID: #VU20840

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13518

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the application. A remote attacker can send a specially crafted project file, trigger stack-based buffer overflow and execute arbitrary code under the privileges of the application.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Information disclosure

EUVDB-ID: #VU20458

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13511

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the specific flaw exists within the processing of project files. A remote attacker can trick a victim to open a specially crafted Arena file and gain unauthorized access to sensitive information related to the targeted workstation.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Use-after-free

EUVDB-ID: #VU20457

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13510

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing the Arena files. A remote attacker can trick a victim to open a specially crafted Arena file and crash the application or execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Out-of-bounds read

EUVDB-ID: #VU20456

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-13512

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the device. A local attacker can trigger out-of-bounds read error and read limited information from the device.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Protection Mechanism Failure

EUVDB-ID: #VU20455

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13516

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass certain restrictions.

The vulnerability exists due to the cross-site request forgery protection setting that has not taken effect. A local authenticated attacker can bypass certain security restrictions on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU20454

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13515

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exists due to the information written to log files can be of a sensitive nature or expose sensitive user information. A remote authenticated attacker can disclose sensitive information.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Use-after-free

EUVDB-ID: #VU20351

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13514

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a specially crafted project file. A local attacker can send a specially crafted project file, trigger a use-after-free vulnerability, gain sensitive information on the target system, execute arbitrary code, or crash the application.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Out-of-bounds read

EUVDB-ID: #VU20350

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13513

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing a specially crafted project file. A local attacker can create a specially crafted project file, trigger out-of-bounds read error and read contents of memory on the system and cause it to crash.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU23492

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1352

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Missing Authentication for Critical Function

EUVDB-ID: #VU22283

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13525

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to access sensitive information on the target system.

The vulnerability exists due to the integrated web server does not perform any authentication for functionality that requires a provable user identity. A remote attacker can download configuration files directly through a URL without authentication and expose configuration and authorized visitor information.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Cross-site request forgery

EUVDB-ID: #VU21726

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:U/RC:C]

CVE-ID: CVE-2019-13529

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

26) Command Injection

EUVDB-ID: #VU21332

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13521

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to improper input validation when processing the .DOE files. A remote attacker can trick a victim to open a specially crafted .DOE file and execute arbitrary commands on the target system without prompting the user.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Access of uninitialized pointer

EUVDB-ID: #VU21330

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13527

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to the affected software accesses or uses a pointer that has not been initialized. A remote attacker can trick a victim to open a specially crafted Arena file, which results in the use of a pointer that has not been initialized and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Improper Authorization

EUVDB-ID: #VU21231

Risk: Low

CVSSv3.1: 2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13528

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing authorization checks. A local authenticated user can gain read access to privileged files.

The following versions are vulnerable:

Niagara AX 3.8u4:
- OS Dist: 2.7.402.2
- NRE Config Dist: 3.8.401.1
Niagara 4.4u3:
- OS Dist: 4.4.73.38.1 NRE Config
- Dist: 4.4.94.14.1
Niagara 4.7u1:
- OS Dist: (JACE 8000) 4.7.109.16.1
- OS Dist (Edge 10): 4.7.109.18.1
- NRE Config Dist: 4.7.110.32.1

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Improper access control

EUVDB-ID: #VU21209

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13523

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the integrated web server of the affected devices allows to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders). A remote attacker can gain unauthorized access to view device configuration information.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Buffer overflow

EUVDB-ID: #VU20839

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13522

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the application. A remote attacker can create a specially crafted project file, trick the victim into opening it, trigger memory corruption and execute arbitrary code under the privileges of the application.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Authentication bypass using an alternate path or channel

EUVDB-ID: #VU20419

Risk: Medium

CVSSv3.1: 7 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13526

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exist due to improper implementation of the authentication process. A remote authenticated attacker can bypass authentication through issues in the HTTP authentication process and execute arbitrary code on the target device.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Stack-based buffer overflow

EUVDB-ID: #VU20346

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13520

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the affected application when processing SDP files. A remote unauthenticated attacker can send a specially crafted project files, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Reversible One-Way Hash

EUVDB-ID: #VU22639

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13539

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a local user to bypass authentication on the target system.

The vulnerability exists due to the the affected products use the decrypt algorithm for OS password hashing. While interactive, network-based logins are disable and local user can use other vulnerabilities to obtain local shell access and access these hashes.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Protection Mechanism Failure

EUVDB-ID: #VU22638

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13535

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass certain restrictions.

The vulnerability exists due to the RFID security mechanism does not apply read protection. An attacker with physical access to the device can gain full read access of the RFID security mechanism data.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper Authentication

EUVDB-ID: #VU22637

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13531

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments. An attacker with physical access to the device can connect inauthentic instruments to the generator, bypass authentication process and gain unauthorized access to the application.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Stack-based buffer overflow

EUVDB-ID: #VU21935

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13537

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a server-side crash.

The vulnerability exists due to a boundary error in the IEC870IP driver. A remote unauthenticated attacker can trigger stack-based buffer overflow and cause a server-side crash on the target system.

Note: This vulnerability affects only the IEC870IP driver used in Vijeo Citect and Citect SCADA.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Download of code without integrity check

EUVDB-ID: #VU21105

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13534

CWE-ID: CWE-494 - Download of Code Without Integrity Check

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. A remote attacker with ability to perform a man-in-the-middle attack can execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Use of Hard-coded Password

EUVDB-ID: #VU21104

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13530

CWE-ID: CWE-259 - Use of Hard-coded Password

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. A remote attacker can use these credentials to login via ftp and upload a malicious firmware.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Path traversal

EUVDB-ID: #VU21102

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13532

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the CODESYS V3 web server. A remote attacker can send a specially crafted HTTP or HTTPS request and read arbitrary files outside the restricted working directory of the controller.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Cross-site scripting

EUVDB-ID: #VU21101

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13538

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the CODESYS V3 Library Manager. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Heap-based buffer overflow

EUVDB-ID: #VU21047

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13536

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing specially crafted project files. A remote attacker can send a specially crafted project file, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Input validation error

EUVDB-ID: #VU23491

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1354

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Use of hard-coded credentials

EUVDB-ID: #VU22640

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13543

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials and read files on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Missing Authorization

EUVDB-ID: #VU22452

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-13547

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the an unsecured function. A remote attacker can access the IP address, use the function without authentication and gain access to the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Missing Authentication for Critical Function

EUVDB-ID: #VU22292

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-13549

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to disrupt the primary operations.

The vulnerability exists due to the authentication mechanism does not provide a sufficient level of protection against unauthorized configuration changes. A remote attacker can modify without authentication the primary operations, namely turn the cooling unit on and off and set the temperature set point.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Exposure of resource to wrong sphere

EUVDB-ID: #VU22282

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-13546

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a local attacker to gain access to system resources.

The vulnerability exists due to the error that allows to bypass a lock screen of the Windows operating system when the software is running. An attacker with physical access to the system can bypass the Windows lock screen and gain unauthorized access to the computer.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Out-of-bounds write

EUVDB-ID: #VU21934

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13545

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Input validation error

EUVDB-ID: #VU21933

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13541

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can access sensitive information and execute arbitrary code.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Stack-based buffer overflow

EUVDB-ID: #VU21103

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13548

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the CODESYS V3 web server. A remote unauthenticated attacker can send a specially crafted HTTP or HTTPS request, trigger stack-based buffer overflow and cause a denial-of-service condition or execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) NULL pointer dereference

EUVDB-ID: #VU21099

Risk: Low

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13542

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing requests. A remote authenticated attacker can send a specially crafted request from a trusted OPC UA client and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Out-of-bounds write

EUVDB-ID: #VU21048

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13544

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted project file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Stack-based buffer overflow

EUVDB-ID: #VU21046

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13540

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing specially crafted project files. A remote unauthenticated attacker can send a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Input validation error

EUVDB-ID: #VU23488

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1387

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    git-daemon-2.14.6-1.61.amzn1.i686
    git-debuginfo-2.14.6-1.61.amzn1.i686
    git-2.14.6-1.61.amzn1.i686
    git-svn-2.14.6-1.61.amzn1.i686

noarch:
    perl-Git-2.14.6-1.61.amzn1.noarch
    git-bzr-2.14.6-1.61.amzn1.noarch
    git-email-2.14.6-1.61.amzn1.noarch
    emacs-git-el-2.14.6-1.61.amzn1.noarch
    perl-Git-SVN-2.14.6-1.61.amzn1.noarch
    git-p4-2.14.6-1.61.amzn1.noarch
    git-all-2.14.6-1.61.amzn1.noarch
    git-hg-2.14.6-1.61.amzn1.noarch
    emacs-git-2.14.6-1.61.amzn1.noarch
    gitweb-2.14.6-1.61.amzn1.noarch
    git-cvs-2.14.6-1.61.amzn1.noarch

src:
    git-2.14.6-1.61.amzn1.src

x86_64:
    git-svn-2.14.6-1.61.amzn1.x86_64
    git-daemon-2.14.6-1.61.amzn1.x86_64
    git-debuginfo-2.14.6-1.61.amzn1.x86_64
    git-2.14.6-1.61.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links