The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1943 advisory.

    A flaw was found in the git fast-import command where it provides the export-marks feature that may     unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input     passed to the fast-import command by using the export-marks feature and overwrite arbitrary files, but     would not have complete control on the content of the file. (CVE-2019-1348)

    An improper input validation flaw was discovered in git in the way it handles git submodules. A remote     attacker could abuse this flaw to trick a victim user into recursively cloning a malicious repository,     which, under certain circumstances, could fool git into using the same git directory twice and potentially     cause remote code execution. (CVE-2019-1349)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1350)

    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka     'Git for Visual Studio Tampering Vulnerability'. (CVE-2019-1351)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

    An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352, CVE-2019-1387. (CVE-2019-1354)

    A flaw was discovered where git improperly validates submodules' names used to construct git metadata     paths and does not prevent them from being nested in existing directories used to store another     submodule's metadata. A remote attacker could abuse this flaw to trick a victim user into cloning a     malicious repository containing submodules, which, when recursively cloned, would trigger the flaw and     remotely execute code on the victim's machine. (CVE-2019-1387)

    A security bypass was discovered in git, which allows arbitrary commands to be executed during the update     of git submodules. A remote attacker may trick a victim user into cloning a malicious repository that     initially looks fine, allowing access to bypass the security mechanisms that prevent the execution of     arbitrary commands during the submodule initialization. After following an update of the repository and     the submodules done by the victim user, vulnerable versions of git may use the update setting in the     .gitmodules file and execute arbitrary commands. (CVE-2019-19604)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This is a security release fixing the following issues :

  - CVE-2019-1348: the fast-import stream command 'feature     export-marks=path' allows writing to arbitrary file     paths. As libgit2 does not offer any interface for     fast-import, it is not susceptible to this     vulnerability.

  - CVE-2019-1349: by using NTFS 8.3 short names,     backslashes or alternate filesystreams, it is possible     to cause submodules to be written into pre-existing     directories during a recursive clone using git. As     libgit2 rejects cloning into non-empty directories by     default, it is not susceptible to this vulnerability.

  - CVE-2019-1350: recursive clones may lead to arbitrary     remote code executing due to improper quoting of command     line arguments. As libgit2 uses libssh2, which does not     require us to perform command line parsing, it is not     susceptible to this vulnerability.

  - CVE-2019-1351: Windows provides the ability to     substitute drive letters with arbitrary letters,     including multi-byte Unicode letters. To fix any     potential issues arising from interpreting such paths as     relative paths, we have extended detection of DOS drive     prefixes to accomodate for such cases.

  - CVE-2019-1352: by using NTFS-style alternative file     streams for the '.git' directory, it is possible to     overwrite parts of the repository. While this has been     fixed in the past for Windows, the same vulnerability     may also exist on other systems that write to NTFS     filesystems. We now reject any paths starting with     '.git:' on all systems.

  - CVE-2019-1353: by using NTFS-style 8.3 short names, it     was possible to write to the '.git' directory and thus     overwrite parts of the repository, leading to possible     remote code execution. While this problem was already     fixed in the past for Windows, other systems accessing     NTFS filesystems are vulnerable to this issue too. We     now enable NTFS protecions by default on all systems to     fix this attack vector.

  - CVE-2019-1354: on Windows, backslashes are not a valid     part of a filename but are instead interpreted as     directory separators. As other platforms allowed to use     such paths, it was possible to write such invalid     entries into a Git repository and was thus an attack     vector to write into the '.git' dierctory. We now reject     any entries starting with '.git' on all systems.

  - CVE-2019-1387: it is possible to let a submodule's git     directory point into a sibling's submodule directory,     which may result in overwriting parts of the Git     repository and thus lead to arbitrary command execution.
    As libgit2 doesn't provide any way to do submodule     clones natively, it is not susceptible to this     vulnerability. Users of libgit2 that have implemented     recursive submodule clones manually are encouraged to     review their implementation for this vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Per the upstream release announcement&sup1;, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE identifiers.'

Refer to the 2.14.6 release notes&sup2; for details on these vulnerabilities and the 2.24.0 release notes&sup3; for details on other improvements and fixes since 2.23.0.

&sup1;
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com / &sup2;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt &sup3;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.24.0.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git fixes the following issues :

Security issues fixed :

  - CVE-2019-1349: Fixed issue on Windows, when submodules     are cloned recursively, under certain circumstances Git     could be fooled into using the same Git directory twice     (bsc#1158787).

  - CVE-2019-19604: Fixed a recursive clone followed by a     submodule update could execute code contained within the     repository without the user explicitly having asked for     that (bsc#1158795).

  - CVE-2019-1387: Fixed recursive clones that are currently     affected by a vulnerability that is caused by too-lax     validation of submodule names, allowing very targeted     attacks via remote code execution in recursive clones     (bsc#1158793).

  - CVE-2019-1354: Fixed issue on Windows that refuses to     write tracked files with filenames that contain     backslashes (bsc#1158792).

  - CVE-2019-1353: Fixed issue when run in the Windows     Subsystem for Linux while accessing a working directory     on a regular Windows drive, none of the NTFS protections     were active (bsc#1158791).

  - CVE-2019-1352: Fixed issue on Windows was unaware of     NTFS Alternate Data Streams (bsc#1158790).

  - CVE-2019-1351: Fixed issue on Windows mistakes drive     letters outside of the US-English alphabet as relative     paths (bsc#1158789).

  - CVE-2019-1350: Fixed incorrect quoting of command-line     arguments allowed remote code execution during a     recursive clone in conjunction with SSH URLs     (bsc#1158788).

  - CVE-2019-1348: Fixed the --export-marks option of     fast-import is exposed also via the in-stream command     feature export-marks=... and it allows overwriting     arbitrary paths (bsc#1158785).

  - Fixes an issue where git send-email failed to     authenticate with SMTP server (bsc#1082023)

Bug fixes :

  - Add zlib dependency, which used to be provided by     openssl-devel, so that package can compile successfully     after openssl upgrade to 1.1.1. (bsc#1149792).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Arbitrary command execution is possible in Git before     2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2,     2.23.x before 2.23.1, and 2.24.x before 2.24.1 because     a 'git submodule update' operation can run commands     found in the .gitmodules file of a malicious     repository.(CVE-2019-19604)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. Recursive clones are     currently affected by a vulnerability that is caused by     too-lax validation of submodule names, allowing very     targeted attacks via remote code execution in recursive     clones.(CVE-2019-1387)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352,     CVE-2019-1387.(CVE-2019-1354)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the     Windows Subsystem for Linux (also known as 'WSL') while     accessing a working directory on a regular Windows     drive, none of the NTFS protections were     active.(CVE-2019-1353)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1352)

  - A tampering vulnerability exists when Git for Visual     Studio improperly handles virtual drive paths, aka 'Git     for Visual Studio Tampering     Vulnerability'.(CVE-2019-1351)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1350)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1350,     CVE-2019-1352, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1349)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. The --export-marks     option of git fast-import is exposed also via the     in-stream command feature export-marks=... and it     allows overwriting arbitrary paths.(CVE-2019-1348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4356 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    The following packages have been upgraded to a later upstream version: git (2.18.2). (BZ#1784058)

    Security Fix(es):

    * git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

    * git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

    * git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

    * git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams     (CVE-2019-1352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2818 advisory.

    A flaw was found in the git fast-import command where it provides the export-marks feature that may     unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input     passed to the fast-import command by using the export-marks feature and overwrite arbitrary files, but     would not have complete control on the content of the file. (CVE-2019-1348)

    An improper input validation flaw was discovered in git in the way it handles git submodules. A remote     attacker could abuse this flaw to trick a victim user into recursively cloning a malicious repository,     which, under certain circumstances, could fool git into using the same git directory twice and potentially     cause remote code execution. (CVE-2019-1349)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1350)

    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka     'Git for Visual Studio Tampering Vulnerability'. (CVE-2019-1351)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

    An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352, CVE-2019-1387. (CVE-2019-1354)

    A flaw was discovered where git improperly validates submodules' names used to construct git metadata     paths and does not prevent them from being nested in existing directories used to store another     submodule's metadata. A remote attacker could abuse this flaw to trick a victim user into cloning a     malicious repository containing submodules, which, when recursively cloned, would trigger the flaw and     remotely execute code on the victim's machine. (CVE-2019-1387)

    A security bypass was discovered in git, which allows arbitrary commands to be executed during the update     of git submodules. A remote attacker may trick a victim user into cloning a malicious repository that     initially looks fine, allowing access to bypass the security mechanisms that prevent the execution of     arbitrary commands during the submodule initialization. After following an update of the repository and     the submodules done by the victim user, vulnerable versions of git may use the update setting in the     .gitmodules file and execute arbitrary commands. (CVE-2019-19604)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.(CVE-2019-1348)

When submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice. We now require the directory to be empty.(CVE-2019-1349)

Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs.
(CVE-2019-1350)

While the only permitted drive letters for physical drives on Windows are letters of the US-English alphabet, this restriction does not apply to virtual drives . Git mistook such paths for relative paths, allowing writing outside of the worktree while cloning.
(CVE-2019-13510)

Git was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone.(CVE-2019-1352)

When running Git in the Windows Subsystem for Linux (also known as 'WSL') while accessing a working directory on a regular Windows drive, none of the NTFS protections were active. (CVE-2019-1353)

Filenames on Linux/Unix can contain backslashes. On Windows, backslashes are directory separators. Git did not use to refuse to write out tracked files with such filenames.(CVE-2019-1354)

Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.(CVE-2019-1387)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
171819	Amazon Linux 2 : git (ALAS-2023-1943)	Nessus	Amazon Linux Local Security Checks	2023/2/23	2024/12/11	critical
132084	Fedora 31 : libgit2 (2019-9c3d054f39)	Nessus	Fedora Local Security Checks	2019/12/17	2024/4/4	critical
132119	Fedora 31 : git (2019-c841bcc3b9)	Nessus	Fedora Local Security Checks	2019/12/18	2024/4/4	critical
133344	openSUSE Security Update : git (openSUSE-2020-123)	Nessus	SuSE Local Security Checks	2020/1/30	2024/3/28	critical
135148	EulerOS Virtualization for ARM 64 3.0.6.0 : git (EulerOS-SA-2020-1361)	Nessus	Huawei Local Security Checks	2020/4/2	2024/3/20	critical
132331	RHEL 8 : git (RHSA-2019:4356)	Nessus	Red Hat Local Security Checks	2019/12/20	2024/11/7	high
234508	Amazon Linux 2 : git (ALAS-2025-2818)	Nessus	Amazon Linux Local Security Checks	2025/4/17	2025/10/30	critical
132026	Amazon Linux AMI : git (ALAS-2019-1325)	Nessus	Amazon Linux Local Security Checks	2019/12/13	2024/4/4	critical
135580	SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)	Nessus	SuSE Local Security Checks	2020/4/15	2022/5/13	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

high

critical

critical

critical