Vulnerability Description
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Git-Scm | Git | >= 2.14.0, < 2.14.6 |
| Opensuse | Leap | 15.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
- https://access.redhat.com/errata/RHSA-2020:0228Third Party Advisory
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://security.gentoo.org/glsa/202003-30
- https://security.gentoo.org/glsa/202003-42
- https://support.apple.com/kb/HT210729
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
- https://access.redhat.com/errata/RHSA-2020:0228Third Party Advisory
- https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
- https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
- https://security.gentoo.org/glsa/202003-30
- https://security.gentoo.org/glsa/202003-42
FAQ
What is CVE-2019-1348?
CVE-2019-1348 is a vulnerability with a CVSS score of 3.3 (LOW). An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via...
How severe is CVE-2019-1348?
CVE-2019-1348 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-1348?
Check the references section above for vendor advisories and patch information. Affected products include: Git-Scm Git, Opensuse Leap.