Skip to content
OpenAdvisories
High ALAS2-2019-1371 9 CVEs

Important: git security update (Amazon Linux 2)

Published Dec 13, 2019 · Updated Mar 23, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19604: Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository. 1781971: CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent CVE-2019-1387: No description is available for this CVE. 1781127: CVE-2019-1387 git: remote code execution in recursive clones with nested submodules CVE-2019-1354: No description is available for this CVE. 1781968: CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames CVE-2019-1353: No description is available for this CVE. 1781966: CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux CVE-2019-1352: No description is available for this CVE. 1781963: CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams CVE-2019-1351: No description is available for this CVE. 1781960: CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning CVE-2019-1350: No description is available for this CVE. 1781958: CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone CVE-2019-1349: No description is available for this CVE. 1781143: CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ CVE-2019-1348: No description is available for this CVE. 1781953: CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 git 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-all 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-core 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-core-doc 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-cvs 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-daemon 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-debuginfo 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-email 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-gui 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-instaweb 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-p4 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-subtree 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 git-svn 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 gitk 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 gitweb 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 perl-Git 0:2.23.1-1.amzn2.0.1
Amazon Linux · 2 perl-Git-SVN 0:2.23.1-1.amzn2.0.1

Vulnerabilities 9

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1348.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1349.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1350.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1351.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1352.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1353.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1354.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-1387.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19604.html