Skip to content
OpenAdvisories
High ALAS2-2018-1136 1 CVE

Important: git security update (Amazon Linux 2)

Published Dec 18, 2018 · Updated Dec 19, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19486: Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017. 1653143: CVE-2018-19486 git: Improper handling of PATH allows for commands to be executed from the current directory

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 git 0:2.17.2-2.amzn2
Amazon Linux · 2 git-all 0:2.17.2-2.amzn2
Amazon Linux · 2 git-core 0:2.17.2-2.amzn2
Amazon Linux · 2 git-core-doc 0:2.17.2-2.amzn2
Amazon Linux · 2 git-cvs 0:2.17.2-2.amzn2
Amazon Linux · 2 git-daemon 0:2.17.2-2.amzn2
Amazon Linux · 2 git-debuginfo 0:2.17.2-2.amzn2
Amazon Linux · 2 git-email 0:2.17.2-2.amzn2
Amazon Linux · 2 git-gui 0:2.17.2-2.amzn2
Amazon Linux · 2 git-p4 0:2.17.2-2.amzn2
Amazon Linux · 2 git-subtree 0:2.17.2-2.amzn2
Amazon Linux · 2 git-svn 0:2.17.2-2.amzn2
Amazon Linux · 2 gitk 0:2.17.2-2.amzn2
Amazon Linux · 2 gitweb 0:2.17.2-2.amzn2
Amazon Linux · 2 perl-Git 0:2.17.2-2.amzn2
Amazon Linux · 2 perl-Git-SVN 0:2.17.2-2.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19486.html