Description
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | git | 1:2.19.2-1 | — |
| Debian 13 | git | 1:2.19.2-1 | — |
| Debian 12 | git | 1:2.19.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | git | 1:2.17.1-1ubuntu0.4 | USN-3829-1 |
| Ubuntu 16.04 LTS | git | 1:2.7.4-0ubuntu1.6 | USN-3829-1 |
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.10 | USN-3829-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-git218-git +15 | 2.18.1-3.el7 | RHSA-2018:3800 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | git | 2.16.4-3.9.2 | SUSE-SU-2018:4190-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.33.0-1.3 | openSUSE-SU-2024:10786-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.8 | git | 2.18.1-r1 | — |
| Alpine v3.6 | git | 2.13.7-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | git +14 | 2.17.2-2.amzn2 | ALAS2-2018-1136 |
Advisories 5
- RHSA-2018:3800 Red Hat Security Advisory: rh-git218-git security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3829-1 git vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2018:4190-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10786-1 git-2.33.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2018-1136 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 19, 2018
References
- https://git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60
- 106020 vdb-entry
- https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt
- 1042166 vdb-entry
- RHSA-2018:3800 vendor-advisory
- USN-3829-1 vendor-advisory
- GLSA-201904-13 vendor-advisory