The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4220-1 advisory.

    Joern Schneeweisz and Nicolas Joly discovered that Git contained various security flaws. An attacker could     possibly use these issues to overwrite arbitrary paths, execute arbitrary code, and overwrite files in the     .git directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning (CVE-2019-1351)

NTFS protections inactive when running Git in the Windows Subsystem for Linux (CVE-2019-1353)

remote code execution in recursive clones with nested submodules (CVE-2019-1387)

Arbitrary path overwriting via export-marks command option (CVE-2019-1348)

Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams (CVE-2019-1352)

recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ (CVE-2019-1349)

Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone (CVE-2019-1350)

Git does not refuse to write out tracked files with backlashes in filenames (CVE-2019-1354)

Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a 'git submodule update' operation can run commands found in the .gitmodules file of a malicious repository.(CVE-2019-19604)

Per the upstream release announcement&sup1;, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE identifiers.'

Refer to the 2.14.6 release notes&sup2; for details on these vulnerabilities.

&sup1;
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com / &sup2;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git fixes the following issues :

Security issues fixed :

CVE-2019-1349: Fixed issue on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice (bsc#1158787).

CVE-2019-19604: Fixed a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that (bsc#1158795).

CVE-2019-1387: Fixed recursive clones that are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones (bsc#1158793).

CVE-2019-1354: Fixed issue on Windows that refuses to write tracked files with filenames that contain backslashes (bsc#1158792).

CVE-2019-1353: Fixed issue when run in the Windows Subsystem for Linux while accessing a working directory on a regular Windows drive, none of the NTFS protections were active (bsc#1158791).

CVE-2019-1352: Fixed issue on Windows was unaware of NTFS Alternate Data Streams (bsc#1158790).

CVE-2019-1351: Fixed issue on Windows mistakes drive letters outside of the US-English alphabet as relative paths (bsc#1158789).

CVE-2019-1350: Fixed incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs (bsc#1158788).

CVE-2019-1348: Fixed the --export-marks option of fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths (bsc#1158785).

Fixes an issue where git send-email failed to authenticate with SMTP server (bsc#1082023)

Bug fixes: Add zlib dependency, which used to be provided by openssl-devel, so that package can compile successfully after openssl upgrade to 1.1.1. (bsc#1149792).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0228 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    The following packages have been upgraded to a later upstream version: git (2.18.2). (BZ#1784057)

    Security Fix(es):

    * git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

    * git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

    * git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

    * git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams     (CVE-2019-1352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0420 advisory.

    This advisory aggregates security fixes for the git SRPM in CIQ LTS 9.2. It addresses 19 CVEs:
    CVE-2019-1348, CVE-2019-1353, CVE-2017-15298, CVE-2018-17456, CVE-2019-1350, and 14 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
132015	Ubuntu 16.04 LTS / 18.04 LTS : Git vulnerabilities (USN-4220-1)	Nessus	Ubuntu Local Security Checks	2019/12/12	2024/8/27	critical
132259	Amazon Linux 2 : git (ALAS-2019-1371)	Nessus	Amazon Linux Local Security Checks	2019/12/19	2024/4/3	critical
132639	Fedora 30 : git (2019-1cec196e20)	Nessus	Fedora Local Security Checks	2020/1/6	2024/4/1	critical
132745	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2020:0045-1)	Nessus	SuSE Local Security Checks	2020/1/9	2024/4/1	critical
133281	RHEL 8 : git (RHSA-2020:0228)	Nessus	Red Hat Local Security Checks	2020/1/28	2024/11/7	high
354825	Rocky Linux 9.2 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (ciqsa-2026_0420)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	high

検出

プラグインの検索

critical

critical

critical

critical

high

high