Command injection in Git - CVE-2018-19486

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16148

Command injection in Git - CVE-2018-19486

Published: November 28, 2018 / Updated: November 28, 2018


Vulnerability identifier: #VU16148
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19486
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.

The vulnerability exists due to a flaw in the run_command() API and 'run-command.c' when handling malicious input. A remote attacker can issue specially crafted commands from the current working directory and execute arbitrary commands on the target system.


Affected software

Git
Amazon Linux AMI
Gentoo Linux
Opensuse
Fedora
git (Alpine package)
git

How to mitigate CVE-2018-19486

Update to version 2.19.2.

Git - update to 2.19.2
git (Alpine package) - update to 2.13.7-r2
git - addressed in versions 2.17.2-2.fc28, 2.19.2-1.fc29

External References

Related Security Bulletins