This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2018-17456 →
DEBIAN-CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code...
Original description
The description as published by the source.
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.19.1-1"}]}]
Debian:13
git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.19.1-1"}]}]
Debian:14
git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.19.1-1"}]}]
References
- advisory security-tracker.debian.org