This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2019-1387 →
DEBIAN-CVE-2019-1387
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clon...
Original description
The description as published by the source.
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.24.0-2"}]}]
Debian:13
git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.24.0-2"}]}]
Debian:14
git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.24.0-2"}]}]
References
- advisory security-tracker.debian.org