Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system.

  - CVE-2019-1348     It was reported that the --export-marks option of git     fast-import is exposed also via the in-stream command     feature export-marks=..., allowing to overwrite     arbitrary paths.

  - CVE-2019-1387     It was discovered that submodule names are not validated     strictly enough, allowing very targeted attacks via     remote code execution when performing recursive clones.

  - CVE-2019-19604     Joern Schneeweisz reported a vulnerability, where a     recursive clone followed by a submodule update could     execute code contained within the repository without the     user explicitly having asked for that. It is now     disallowed for `.gitmodules` to have entries that set     `submodule.<name>.update=!command`.

In addition this update addresses a number of security issues which are only an issue if git is operating on an NTFS filesystem (CVE-2019-1349, CVE-2019-1352 and CVE-2019-1353 ).

Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system.

CVE-2019-1348

It was reported that the --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=..., allowing to overwrite arbitrary paths.

CVE-2019-1387

It was discovered that submodule names are not validated strictly enough, allowing very targeted attacks via remote code execution when performing recursive clones.

In addition this update addresses a number of security issues which are only an issue if git is operating on an NTFS filesystem (CVE-2019-1349, CVE-2019-1352 and CVE-2019-1353).

For Debian 8 'Jessie', these problems have been fixed in version 1:2.1.4-2.1+deb8u8.

We recommend that you upgrade your git packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0053 advisory.

    This advisory aggregates security fixes for the git SRPM in CIQ LTS 8.6. It addresses 22 CVEs:
    CVE-2019-1348, CVE-2019-1353, CVE-2009-2108, CVE-2025-48384, CVE-2017-15298, and 17 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

According to the versions of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Arbitrary command execution is possible in Git before     2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2,     2.23.x before 2.23.1, and 2.24.x before 2.24.1 because     a 'git submodule update' operation can run commands     found in the .gitmodules file of a malicious     repository.(CVE-2019-19604)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. Recursive clones are     currently affected by a vulnerability that is caused by     too-lax validation of submodule names, allowing very     targeted attacks via remote code execution in recursive     clones.(CVE-2019-1387)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352,     CVE-2019-1387.(CVE-2019-1354)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the     Windows Subsystem for Linux (also known as 'WSL') while     accessing a working directory on a regular Windows     drive, none of the NTFS protections were     active.(CVE-2019-1353)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1352)

  - A tampering vulnerability exists when Git for Visual     Studio improperly handles virtual drive paths, aka 'Git     for Visual Studio Tampering     Vulnerability'.(CVE-2019-1351)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1350)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1350,     CVE-2019-1352, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1349)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. The --export-marks     option of git fast-import is exposed also via the     in-stream command feature export-marks=... and it     allows overwriting arbitrary paths.(CVE-2019-1348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4356 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    The following packages have been upgraded to a later upstream version: git (2.18.2). (BZ#1784058)

    Security Fix(es):

    * git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

    * git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

    * git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

    * git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams     (CVE-2019-1352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2818 advisory.

    A flaw was found in the git fast-import command where it provides the export-marks feature that may     unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input     passed to the fast-import command by using the export-marks feature and overwrite arbitrary files, but     would not have complete control on the content of the file. (CVE-2019-1348)

    An improper input validation flaw was discovered in git in the way it handles git submodules. A remote     attacker could abuse this flaw to trick a victim user into recursively cloning a malicious repository,     which, under certain circumstances, could fool git into using the same git directory twice and potentially     cause remote code execution. (CVE-2019-1349)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1350)

    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka     'Git for Visual Studio Tampering Vulnerability'. (CVE-2019-1351)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

    An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352, CVE-2019-1387. (CVE-2019-1354)

    A flaw was discovered where git improperly validates submodules' names used to construct git metadata     paths and does not prevent them from being nested in existing directories used to store another     submodule's metadata. A remote attacker could abuse this flaw to trick a victim user into cloning a     malicious repository containing submodules, which, when recursively cloned, would trigger the flaw and     remotely execute code on the victim's machine. (CVE-2019-1387)

    A security bypass was discovered in git, which allows arbitrary commands to be executed during the update     of git submodules. A remote attacker may trick a victim user into cloning a malicious repository that     initially looks fine, allowing access to bypass the security mechanisms that prevent the execution of     arbitrary commands during the submodule initialization. After following an update of the repository and     the submodules done by the victim user, vulnerable versions of git may use the update setting in the     .gitmodules file and execute arbitrary commands. (CVE-2019-19604)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.(CVE-2019-1348)

When submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice. We now require the directory to be empty.(CVE-2019-1349)

Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs.
(CVE-2019-1350)

While the only permitted drive letters for physical drives on Windows are letters of the US-English alphabet, this restriction does not apply to virtual drives . Git mistook such paths for relative paths, allowing writing outside of the worktree while cloning.
(CVE-2019-13510)

Git was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone.(CVE-2019-1352)

When running Git in the Windows Subsystem for Linux (also known as 'WSL') while accessing a working directory on a regular Windows drive, none of the NTFS protections were active. (CVE-2019-1353)

Filenames on Linux/Unix can contain backslashes. On Windows, backslashes are directory separators. Git did not use to refuse to write out tracked files with such filenames.(CVE-2019-1354)

Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.(CVE-2019-1387)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
131966	Debian DSA-4581-1 : git - security update	Nessus	Debian Local Security Checks	2019/12/12	2024/4/4	critical
133218	Debian DLA-2059-1 : git security update	Nessus	Debian Local Security Checks	2020/1/24	2024/3/29	critical
357422	Rocky Linux 8.6 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (ciqsa-2026_0053)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
333673	Photon OS 5.0: Git PHSA-2025-5.0-91-0590	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	low
135148	EulerOS Virtualization for ARM 64 3.0.6.0 : git (EulerOS-SA-2020-1361)	Nessus	Huawei Local Security Checks	2020/4/2	2024/3/20	critical
132331	RHEL 8 : git (RHSA-2019:4356)	Nessus	Red Hat Local Security Checks	2019/12/20	2024/11/7	high
234508	Amazon Linux 2 : git (ALAS-2025-2818)	Nessus	Amazon Linux Local Security Checks	2025/4/17	2025/10/30	critical
132026	Amazon Linux AMI : git (ALAS-2019-1325)	Nessus	Amazon Linux Local Security Checks	2019/12/13	2024/4/4	critical
135580	SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)	Nessus	SuSE Local Security Checks	2020/4/15	2022/5/13	critical

検出

プラグインの検索

critical

critical

high

low

critical

high

critical

critical

critical