CVE-2019-1348 : An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

Published 2020-01-24 22:15:19

Updated 2021-01-26 14:47:13

Source Microsoft Corporation

View at NVD, CVE.org

Products affected by CVE-2019-1348

Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.22.0 and before (<) 2.22.2
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.17.0 and before (<) 2.17.3
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.21.0 and before (<) 2.21.1
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.19.0 and before (<) 2.19.3
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.15.0 and before (<) 2.15.4
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.18.0 and before (<) 2.18.2
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.24.0 and before (<) 2.24.1
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.20.0 and before (<) 2.20.2
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.23.0 and before (<) 2.23.1
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.14.0 and before (<) 2.14.6
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions
Git-scm » GIT
Versions from including (>=) 2.16.0 and before (<) 2.16.6
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-1348

EPSS FAQ

0.03%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 7 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1348

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:P	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

References for CVE-2019-1348

https://support.apple.com/kb/HT210729

About the security content of Xcode 11.2 - Apple Support
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html

[security-announce] openSUSE-SU-2020:0598-1: moderate: Security update f

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html

[security-announce] openSUSE-SU-2020:0123-1: important: Security update
Third Party Advisory

CVEs referencing this url
https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/

[ANNOUNCE] Git v2.24.1 and others - Junio C Hamano
Release Notes;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2020:0228

RHSA-2020:0228 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202003-42

libgit2: Multiple vulnerabilities (GLSA 202003-42) — Gentoo security

CVEs referencing this url
https://security.gentoo.org/glsa/202003-30

Git: Multiple vulnerabilities (GLSA 202003-30) — Gentoo security

CVEs referencing this url
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u

[ANNOUNCE] Git v2.24.1 and others
Release Notes;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-1348

Products affected by CVE-2019-1348

Exploit prediction scoring system (EPSS) score for CVE-2019-1348

CVSS scores for CVE-2019-1348

References for CVE-2019-1348