{"resultsPerPage":41,"startIndex":0,"totalResults":41,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-24T03:09:44.830","vulnerabilities":[{"cve":{"id":"CVE-2008-5516","sourceIdentifier":"secalert@redhat.com","published":"2009-01-20T16:30:00.327","lastModified":"2026-06-16T23:00:27.577","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search."},{"lang":"es","value":"La interfaz web en git (gitweb) versiones 1.5.x anteriores a 1.5.5, permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres de shell relacionados con git_search."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-264"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9j:*:*:*:*:*:*:*","matchCriteriaId":"93DA4D8D-3386-4A22-8951-96DDF8B2AB4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9k:*:*:*:*:*:*:*","matchCriteriaId":"88AE94F1-4C8D-4CB2-80CA-70BDDAA15E5E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9l:*:*:*:*:*:*:*","matchCriteriaId":"D886507B-0192-4D0F-80EE-0E1FD4F2CB9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9m:*:*:*:*:*:*:*","matchCriteriaId":"E3E13512-B8F7-4AA4-9551-71FBA7B746D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9n:*:*:*:*:*:*:*","matchCriteriaId":"E9154DE6-070E-4E6A-A2E4-B25B243FCE9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"86156029-EE44-45B6-AF73-641502AC8007"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.0b:*:*:*:*:*:*:*","matchCriteriaId":"C7C119CD-4432-4EF8-95BA-BED4C93E609F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"E9BD14EC-D963-4D3A-998F-4041E0F20547"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"7F24CC42-E1E2-4B03-B5D5-7A3050BAE01D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"A0BD6A9F-4AA2-4672-94FA-002B10478166"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"05F3F409-D4F5-4B89-9D9B-63E8041E3700"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.7:*:*:*:*:*:*:*","matchCriteriaId":"228B069E-80BB-4A95-8BBD-66D9C78F2B0D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.8:*:*:*:*:*:*:*","matchCriteriaId":"38EA9447-A92C-43C9-ADD0-F8DCAD57A6C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.1:*:*:*:*:*:*:*","matchCriteriaId":"09E4D3DC-7541-4E37-911C-8EC4258D678C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"84137274-7537-4F23-A193-06B7D85820D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"E6003B70-C2BD-4402-A3DA-9F52FC1EF292"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"D6501938-1E45-4C86-98E8-64D6449674B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"F3E5C886-FE1B-4702-96C3-625FAC27C0B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.6:*:*:*:*:*:*:*","matchCriteriaId":"E9761C27-43EF-4ABF-9B99-FF132147651E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.0:*:*:*:*:*:*:*","matchCriteriaId":"98711B3F-75E7-4116-BC94-ACF9186C7B20"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.1:*:*:*:*:*:*:*","matchCriteriaId":"2F432595-E793-4321-8CDE-0308982403DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.2:*:*:*:*:*:*:*","matchCriteriaId":"506F265F-4EC0-4DA8-8245-F214BE688BF7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.3:*:*:*:*:*:*:*","matchCriteriaId":"36077120-17DD-4C0C-8AB9-398361CA98FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.4:*:*:*:*:*:*:*","matchCriteriaId":"26FB1987-92E9-4379-AF7A-A29AA1BE348C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.5:*:*:*:*:*:*:*","matchCriteriaId":"330A8383-6B47-421C-9655-7F7416164CA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.6:*:*:*:*:*:*:*","matchCriteriaId":"3EE094E0-CE52-46BC-A012-945530B87572"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"8DBC29B5-50FE-4BDA-9CEF-14CFF31581AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.1:*:*:*:*:*:*:*","matchCriteriaId":"058F8DA2-1490-4847-BB87-EF76E0F8A9A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.2:*:*:*:*:*:*:*","matchCriteriaId":"EAA3E46B-D1CD-4F8B-BF76-9161E70832B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.3:*:*:*:*:*:*:*","matchCriteriaId":"DE5EA7B0-6D78-46B7-BEE1-1A0576D56CC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"0243E80A-5F9A-4742-A83A-076CD822E254"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.1:*:*:*:*:*:*:*","matchCriteriaId":"2D8BB818-7D5A-4F56-A8A7-11AB861409F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.1.1:*:*:*:*:*:*:*","matchCriteriaId":"0613B062-A0D6-4403-ADA0-F848F21A3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2:*:*:*:*:*:*:*","matchCriteriaId":"F13D209A-44DD-406B-86CB-3BE1B2C95789"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.1:*:*:*:*:*:*:*","matchCriteriaId":"A6D3BC2F-9E38-4F5F-A559-328323F133FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.2:*:*:*:*:*:*:*","matchCriteriaId":"6B8F3E29-9B94-4F46-8A59-FC02EBD9CD6E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.3:*:*:*:*:*:*:*","matchCriteriaId":"44017E26-4AA6-4E76-B047-24D738D505A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.4:*:*:*:*:*:*:*","matchCriteriaId":"5D883B55-8F7A-48AD-8536-3B7901AE95E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3:*:*:*:*:*:*:*","matchCriteriaId":"B2F644BD-2A37-40C8-8C02-67B671474BD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.1:*:*:*:*:*:*:*","matchCriteriaId":"02EC9660-8197-4992-B8BF-ACA81A1362D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.2:*:*:*:*:*:*:*","matchCriteriaId":"52E67537-51C1-4D9A-AF11-1E6FE3290AAC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.3:*:*:*:*:*:*:*","matchCriteriaId":"3735BAE3-C767-44A3-BDD3-07DDEF9AE5C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.4:*:*:*:*:*:*:*","matchCriteriaId":"25112BF9-B5C3-470D-8FD8-045707FA83FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.5:*:*:*:*:*:*:*","matchCriteriaId":"46E0026C-93EF-4B4F-AEF2-E84F5EA1DCAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4:*:*:*:*:*:*:*","matchCriteriaId":"562BD162-990B-4BAF-9074-11FCA1DFC4A9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.1:*:*:*:*:*:*:*","matchCriteriaId":"51B7B233-CCD6-4A58-B76D-990D1DCF1BA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.2:*:*:*:*:*:*:*","matchCriteriaId":"7AB103FA-9580-4A2C-AF16-12909B5E47A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.3:*:*:*:*:*:*:*","matchCriteriaId":"8CF296EC-FECD-4F70-BBA8-D57C891E35A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.4:*:*:*:*:*:*:*","matchCriteriaId":"24B2BC27-CA73-4C45-9726-5178DB43DB94"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:*:*:*:*:*:*:*","matchCriteriaId":"9BC291EB-F083-4E66-B61B-50723E0E8A5D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"0756E43B-F13B-4EB4-89B3-9A7A6CA6DDA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:rc3:*:*:*:*:*:*","matchCriteriaId":"23E68B79-8E0C-4001-AECD-ED0AF81825B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:rc4:*:*:*:*:*:*","matchCriteriaId":"6FAC3AF5-D66D-4972-B2C7-9D1CD784884A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"1BE75459-E53B-4E3A-B94A-3A7DA916A4AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.2:*:*:*:*:*:*:*","matchCriteriaId":"0A51E31C-06CD-463F-BF7D-F14979AB492B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.3:*:*:*:*:*:*:*","matchCriteriaId":"D198227B-3B53-4C29-985E-2596C0909A5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.4:*:*:*:*:*:*:*","matchCriteriaId":"E6347CFA-DC5A-4C0F-A516-02E6BBEDA3AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.5:*:*:*:*:*:*:*","matchCriteriaId":"B4474571-24EB-4D53-8A61-D77E560B0ACE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.6:*:*:*:*:*:*:*","matchCriteriaId":"8B6544F7-D835-45C5-9645-AFEA9F264DE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.7:*:*:*:*:*:*:*","matchCriteriaId":"43E47006-A44B-4BE1-AD6B-CF869C79A2CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1:*:*:*:*:*:*:*","matchCriteriaId":"569F2502-3023-44F6-8767-4DA465B3C754"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.1:*:*:*:*:*:*:*","matchCriteriaId":"4CDF10E4-F882-4BD6-AA56-B56CEC28D1DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.2:*:*:*:*:*:*:*","matchCriteriaId":"909E71D3-A5E4-47AF-B9F4-2A05A4129EFE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.3:*:*:*:*:*:*:*","matchCriteriaId":"73FFB1CD-1C79-4DD8-BCAB-1FCA8D99C89B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.4:*:*:*:*:*:*:*","matchCriteriaId":"4124F148-9281-4465-9E16-67DE47E1F00D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.5:*:*:*:*:*:*:*","matchCriteriaId":"22F07209-3FC5-4AA4-B9BF-18F32D7F402F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.6:*:*:*:*:*:*:*","matchCriteriaId":"DDEF615E-48FB-4F1E-BC8E-B3A70457D474"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2:*:*:*:*:*:*:*","matchCriteriaId":"C43D08FF-7871-481D-A648-015F4DCF68E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.1:*:*:*:*:*:*:*","matchCriteriaId":"A4869796-F69A-49CC-9203-CE80F38E1A23"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.2:*:*:*:*:*:*:*","matchCriteriaId":"03769CFD-3A5F-4C5E-B548-6B8F7EFFDE14"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.3:*:*:*:*:*:*:*","matchCriteriaId":"4F2433A7-3333-407D-8147-9AC736049590"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.4:*:*:*:*:*:*:*","matchCriteriaId":"585B9665-B422-418D-9AEC-65E65D24621B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.5:*:*:*:*:*:*:*","matchCriteriaId":"7DA2677B-1237-4D22-A51E-3A67B6AA9F9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:*:*:*:*:*:*:*","matchCriteriaId":"2D6642BE-13B4-40F8-BFD4-AD1E55B1A3BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:rc4:*:*:*:*:*:*","matchCriteriaId":"18962E5D-185E-4AF8-B0B3-11026B61053D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:rc5:*:*:*:*:*:*","matchCriteriaId":"2EBCE67F-34AC-4635-A2DF-E0C304FAB8E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:rc7:*:*:*:*:*:*","matchCriteriaId":"197F9E88-DE20-44B5-B159-8E7BC3986E9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.1:*:*:*:*:*:*:*","matchCriteriaId":"3BF65B33-FD2F-4F2B-9F67-360F8957FABC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.2:*:*:*:*:*:*:*","matchCriteriaId":"3C668BD7-C4E3-4A12-9987-E565250E2E1F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.3:*:*:*:*:*:*:*","matchCriteriaId":"A3F93314-4F2D-4036-94F7-986B16BEC851"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.4:*:*:*:*:*:*:*","matchCriteriaId":"92A161E8-6CB8-40FF-9D90-00664185F69F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.5:*:*:*:*:*:*:*","matchCriteriaId":"B9533C06-96BF-4D5D-A29C-F2AD2EE5108C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.6:*:*:*:*:*:*:*","matchCriteriaId":"B20EFCED-EC50-4A9B-970B-E29CDBDAABDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.7:*:*:*:*:*:*:*","matchCriteriaId":"CCC5F7F8-EFC2-4FD0-A293-59F76EBFAE05"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.8:*:*:*:*:*:*:*","matchCriteriaId":"361F32F0-8009-40D2-BC14-74AE90CDB36C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:*:*:*:*:*:*:*","matchCriteriaId":"6B6E65D8-0D8E-4D11-82D7-DD3FB3EB1095"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc0:*:*:*:*:*:*","matchCriteriaId":"67535E99-5DD8-4F90-9DB1-5415201E94E2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc1:*:*:*:*:*:*","matchCriteriaId":"F3163CEC-C0D5-401E-93C3-6A5316630FC2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc1.1136.g2794:*:*:*:*:*:*","matchCriteriaId":"8DA19E8C-34DE-4721-88E2-B97774E855E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc2:*:*:*:*:*:*","matchCriteriaId":"ED57760D-0C08-43FE-A837-B00D271EDBA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc3:*:*:*:*:*:*","matchCriteriaId":"BA11029F-E4F7-4D4A-817C-A7CC5AD4E872"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc4:*:*:*:*:*:*","matchCriteriaId":"8A42B9B9-7B29-429D-9ABC-736CCC038813"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc5:*:*:*:*:*:*","matchCriteriaId":"456AD412-970D-495E-8F7F-0CF670C364B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.1:*:*:*:*:*:*:*","matchCriteriaId":"63530521-E600-4326-B057-162E6635554B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.2:*:*:*:*:*:*:*","matchCriteriaId":"0715BCFB-5EAA-4812-BB59-7210CB6670FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.3:*:*:*:*:*:*:*","matchCriteriaId":"E9BBAA74-B0DE-4388-8C1B-8C3FF258EDD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.4:*:*:*:*:*:*:*","matchCriteriaId":"A8CEFC6C-0066-4331-A7A8-02047A19206A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.5:*:*:*:*:*:*:*","matchCriteriaId":"1337EA7C-3E52-47EC-8A32-C61A3B5046A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.6:*:*:*:*:*:*:*","matchCriteriaId":"D9D484DA-BCEA-4873-9F8C-883D702644F7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.7:*:*:*:*:*:*:*","matchCriteriaId":"BF45A2CE-0E19-477F-9393-B8AAD158D285"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:*:*:*:*:*:*:*","matchCriteriaId":"3095075A-5A99-4718-9E5E-56D442A14EAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:rc1:*:*:*:*:*:*","matchCriteriaId":"49D8DA6B-C306-455E-BAF1-0C5C2E1F33B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:rc2:*:*:*:*:*:*","matchCriteriaId":"6881163A-4097-4BAE-A84A-82D819BBF304"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:rc3:*:*:*:*:*:*","matchCriteriaId":"BF31FA87-A8B8-46A1-8945-CB2613FE3B9A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.1:*:*:*:*:*:*:*","matchCriteriaId":"32E6B6B9-BD9A-4DF2-8DDC-B2A55431B3FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.2:*:*:*:*:*:*:*","matchCriteriaId":"0FA7D904-012D-448D-B1F6-885A472B8BCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.3:*:*:*:*:*:*:*","matchCriteriaId":"9C0605BA-481D-4E71-8D57-A99F8CDB7492"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.4:*:*:*:*:*:*:*","matchCriteriaId":"668F528C-50BC-4944-9DC3-95D0413D2359"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.5:*:*:*:*:*:*:*","matchCriteriaId":"E3D715F7-34D2-4D1D-B49B-74AF4D7D7C55"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.6:*:*:*:*:*:*:*","matchCriteriaId":"6DF925DE-031A-451F-83A6-1B355D364358"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.1:*:*:*:*:*:*:*","matchCriteriaId":"AECFAEA8-3B87-4BFE-98A3-58F5129D9BCF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.2:*:*:*:*:*:*:*","matchCriteriaId":"D6228681-1150-4B80-AFB0-451BAEB393A4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.3:*:*:*:*:*:*:*","matchCriteriaId":"E807BBE3-A2EC-4EA2-8222-7A02D03848D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.4:*:*:*:*:*:*:*","matchCriteriaId":"C7122491-D55D-451B-A2BC-D87D283A504E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.6.0:*:*:*:*:*:*:*","matchCriteriaId":"FFB286E1-525B-43B1-8940-0986854BE595"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.7.0:*:*:*:*:*:*:*","matchCriteriaId":"398057EC-27A8-4A84-A01D-E14EEB496A7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:rpath:linux:2:*:*:*:*:*:*:*","matchCriteriaId":"48D2FD6E-C9C1-4DF0-9F01-E869FA97B153"}]}]}],"references":[{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html","source":"secalert@redhat.com"},{"url":"http://repo.or.cz/w/git.git?a=commitdiff%3Bh=c582abae","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/33964","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/34194","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/4919","source":"secalert@redhat.com"},{"url":"http://wiki.rpath.com/Advisories:rPSA-2009-0005","source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2009/dsa-1708","source":"secalert@redhat.com"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/20/1","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/21/7","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/23/2","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/archive/1/500008/100/0/threaded","source":"secalert@redhat.com"},{"url":"http://www.ubuntu.com/usn/USN-723-1","source":"secalert@redhat.com"},{"url":"http://www.vupen.com/english/advisories/2009/0175","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=479715","source":"secalert@redhat.com"},{"url":"https://issues.rpath.com/browse/RPL-2936","source":"secalert@redhat.com"},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://repo.or.cz/w/git.git?a=commitdiff%3Bh=c582abae","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/33964","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/34194","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/4919","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://wiki.rpath.com/Advisories:rPSA-2009-0005","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2009/dsa-1708","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/20/1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/21/7","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2009/01/23/2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/500008/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-723-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2009/0175","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=479715","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://issues.rpath.com/browse/RPL-2936","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2010-2542","sourceIdentifier":"secalert@redhat.com","published":"2010-08-11T18:47:50.687","lastModified":"2026-06-16T23:20:57.107","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy."},{"lang":"es","value":"Desbordamiento de búfer basado en pila en la función is_git_directory en setup.c en Git anterior v1.7.2.1 permite a usuarios locales obtener privilegios a través de un gitdir grande: campo en un fichero .git en una acción copia. \r\n\r\n"}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.2.1","matchCriteriaId":"49093783-9DC6-439F-88A0-133509B2D762"}]}]}],"references":[{"url":"http://git.kernel.org/?p=git/git.git%3Ba=commit%3Bh=3c9d0414ed2db0167e6c828b547be8fc9f88fccc","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html","source":"secalert@redhat.com","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/43457","source":"secalert@redhat.com","tags":["Third Party Advisory"]},{"url":"http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.7.2.1.txt","source":"secalert@redhat.com","tags":["Broken Link"]},{"url":"http://www.openwall.com/lists/oss-security/2010/07/22/1","source":"secalert@redhat.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2010/07/22/4","source":"secalert@redhat.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/41891","source":"secalert@redhat.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2011/0464","source":"secalert@redhat.com","tags":["Permissions Required"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=618108","source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"]},{"url":"http://git.kernel.org/?p=git/git.git%3Ba=commit%3Bh=3c9d0414ed2db0167e6c828b547be8fc9f88fccc","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/43457","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.7.2.1.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://www.openwall.com/lists/oss-security/2010/07/22/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2010/07/22/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/41891","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2011/0464","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=618108","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2010-3906","sourceIdentifier":"security@ubuntu.com","published":"2010-12-17T19:00:20.573","lastModified":"2026-06-16T23:23:47.960","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters."},{"lang":"es","value":"Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Gitweb v1.7.3.3 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) f y (2) fp."}],"affected":[{"source":"security@ubuntu.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9j:*:*:*:*:*:*:*","matchCriteriaId":"93DA4D8D-3386-4A22-8951-96DDF8B2AB4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9k:*:*:*:*:*:*:*","matchCriteriaId":"88AE94F1-4C8D-4CB2-80CA-70BDDAA15E5E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9l:*:*:*:*:*:*:*","matchCriteriaId":"D886507B-0192-4D0F-80EE-0E1FD4F2CB9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9m:*:*:*:*:*:*:*","matchCriteriaId":"E3E13512-B8F7-4AA4-9551-71FBA7B746D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:0.99.9n:*:*:*:*:*:*:*","matchCriteriaId":"E9154DE6-070E-4E6A-A2E4-B25B243FCE9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"86156029-EE44-45B6-AF73-641502AC8007"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.0b:*:*:*:*:*:*:*","matchCriteriaId":"C7C119CD-4432-4EF8-95BA-BED4C93E609F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"E9BD14EC-D963-4D3A-998F-4041E0F20547"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"7F24CC42-E1E2-4B03-B5D5-7A3050BAE01D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"A0BD6A9F-4AA2-4672-94FA-002B10478166"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"05F3F409-D4F5-4B89-9D9B-63E8041E3700"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.7:*:*:*:*:*:*:*","matchCriteriaId":"228B069E-80BB-4A95-8BBD-66D9C78F2B0D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.0.8:*:*:*:*:*:*:*","matchCriteriaId":"38EA9447-A92C-43C9-ADD0-F8DCAD57A6C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.0:*:*:*:*:*:*:*","matchCriteriaId":"9ECD92C3-4B06-447C-BB93-205E7F9A4F02"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.1:*:*:*:*:*:*:*","matchCriteriaId":"09E4D3DC-7541-4E37-911C-8EC4258D678C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"84137274-7537-4F23-A193-06B7D85820D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"E6003B70-C2BD-4402-A3DA-9F52FC1EF292"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"D6501938-1E45-4C86-98E8-64D6449674B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"F3E5C886-FE1B-4702-96C3-625FAC27C0B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.1.6:*:*:*:*:*:*:*","matchCriteriaId":"E9761C27-43EF-4ABF-9B99-FF132147651E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.0:*:*:*:*:*:*:*","matchCriteriaId":"98711B3F-75E7-4116-BC94-ACF9186C7B20"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.1:*:*:*:*:*:*:*","matchCriteriaId":"2F432595-E793-4321-8CDE-0308982403DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.2:*:*:*:*:*:*:*","matchCriteriaId":"506F265F-4EC0-4DA8-8245-F214BE688BF7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.3:*:*:*:*:*:*:*","matchCriteriaId":"36077120-17DD-4C0C-8AB9-398361CA98FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.4:*:*:*:*:*:*:*","matchCriteriaId":"26FB1987-92E9-4379-AF7A-A29AA1BE348C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.5:*:*:*:*:*:*:*","matchCriteriaId":"330A8383-6B47-421C-9655-7F7416164CA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.2.6:*:*:*:*:*:*:*","matchCriteriaId":"3EE094E0-CE52-46BC-A012-945530B87572"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"8DBC29B5-50FE-4BDA-9CEF-14CFF31581AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.1:*:*:*:*:*:*:*","matchCriteriaId":"058F8DA2-1490-4847-BB87-EF76E0F8A9A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.2:*:*:*:*:*:*:*","matchCriteriaId":"EAA3E46B-D1CD-4F8B-BF76-9161E70832B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.3.3:*:*:*:*:*:*:*","matchCriteriaId":"DE5EA7B0-6D78-46B7-BEE1-1A0576D56CC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"0243E80A-5F9A-4742-A83A-076CD822E254"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.1:*:*:*:*:*:*:*","matchCriteriaId":"2D8BB818-7D5A-4F56-A8A7-11AB861409F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.1.1:*:*:*:*:*:*:*","matchCriteriaId":"0613B062-A0D6-4403-ADA0-F848F21A3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2:*:*:*:*:*:*:*","matchCriteriaId":"F13D209A-44DD-406B-86CB-3BE1B2C95789"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.1:*:*:*:*:*:*:*","matchCriteriaId":"A6D3BC2F-9E38-4F5F-A559-328323F133FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.2:*:*:*:*:*:*:*","matchCriteriaId":"6B8F3E29-9B94-4F46-8A59-FC02EBD9CD6E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.3:*:*:*:*:*:*:*","matchCriteriaId":"44017E26-4AA6-4E76-B047-24D738D505A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.2.4:*:*:*:*:*:*:*","matchCriteriaId":"5D883B55-8F7A-48AD-8536-3B7901AE95E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3:*:*:*:*:*:*:*","matchCriteriaId":"B2F644BD-2A37-40C8-8C02-67B671474BD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.1:*:*:*:*:*:*:*","matchCriteriaId":"02EC9660-8197-4992-B8BF-ACA81A1362D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.2:*:*:*:*:*:*:*","matchCriteriaId":"52E67537-51C1-4D9A-AF11-1E6FE3290AAC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.3:*:*:*:*:*:*:*","matchCriteriaId":"3735BAE3-C767-44A3-BDD3-07DDEF9AE5C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.4:*:*:*:*:*:*:*","matchCriteriaId":"25112BF9-B5C3-470D-8FD8-045707FA83FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.3.5:*:*:*:*:*:*:*","matchCriteriaId":"46E0026C-93EF-4B4F-AEF2-E84F5EA1DCAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4:*:*:*:*:*:*:*","matchCriteriaId":"562BD162-990B-4BAF-9074-11FCA1DFC4A9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.1:*:*:*:*:*:*:*","matchCriteriaId":"51B7B233-CCD6-4A58-B76D-990D1DCF1BA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.2:*:*:*:*:*:*:*","matchCriteriaId":"7AB103FA-9580-4A2C-AF16-12909B5E47A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.3:*:*:*:*:*:*:*","matchCriteriaId":"8CF296EC-FECD-4F70-BBA8-D57C891E35A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.4:*:*:*:*:*:*:*","matchCriteriaId":"24B2BC27-CA73-4C45-9726-5178DB43DB94"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.4.4.5:*:*:*:*:*:*:*","matchCriteriaId":"EA8EC58A-89AD-4BA3-B057-3DA6B5E0FD11"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:*:*:*:*:*:*:*","matchCriteriaId":"9BC291EB-F083-4E66-B61B-50723E0E8A5D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"0756E43B-F13B-4EB4-89B3-9A7A6CA6DDA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:rc3:*:*:*:*:*:*","matchCriteriaId":"23E68B79-8E0C-4001-AECD-ED0AF81825B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0:rc4:*:*:*:*:*:*","matchCriteriaId":"6FAC3AF5-D66D-4972-B2C7-9D1CD784884A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"1BE75459-E53B-4E3A-B94A-3A7DA916A4AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.2:*:*:*:*:*:*:*","matchCriteriaId":"0A51E31C-06CD-463F-BF7D-F14979AB492B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.3:*:*:*:*:*:*:*","matchCriteriaId":"D198227B-3B53-4C29-985E-2596C0909A5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.4:*:*:*:*:*:*:*","matchCriteriaId":"E6347CFA-DC5A-4C0F-A516-02E6BBEDA3AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.5:*:*:*:*:*:*:*","matchCriteriaId":"B4474571-24EB-4D53-8A61-D77E560B0ACE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.6:*:*:*:*:*:*:*","matchCriteriaId":"8B6544F7-D835-45C5-9645-AFEA9F264DE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.0.7:*:*:*:*:*:*:*","matchCriteriaId":"43E47006-A44B-4BE1-AD6B-CF869C79A2CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1:*:*:*:*:*:*:*","matchCriteriaId":"569F2502-3023-44F6-8767-4DA465B3C754"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.1:*:*:*:*:*:*:*","matchCriteriaId":"4CDF10E4-F882-4BD6-AA56-B56CEC28D1DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.2:*:*:*:*:*:*:*","matchCriteriaId":"909E71D3-A5E4-47AF-B9F4-2A05A4129EFE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.3:*:*:*:*:*:*:*","matchCriteriaId":"73FFB1CD-1C79-4DD8-BCAB-1FCA8D99C89B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.4:*:*:*:*:*:*:*","matchCriteriaId":"4124F148-9281-4465-9E16-67DE47E1F00D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.5:*:*:*:*:*:*:*","matchCriteriaId":"22F07209-3FC5-4AA4-B9BF-18F32D7F402F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.1.6:*:*:*:*:*:*:*","matchCriteriaId":"DDEF615E-48FB-4F1E-BC8E-B3A70457D474"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2:*:*:*:*:*:*:*","matchCriteriaId":"C43D08FF-7871-481D-A648-015F4DCF68E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.1:*:*:*:*:*:*:*","matchCriteriaId":"A4869796-F69A-49CC-9203-CE80F38E1A23"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.2:*:*:*:*:*:*:*","matchCriteriaId":"03769CFD-3A5F-4C5E-B548-6B8F7EFFDE14"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.3:*:*:*:*:*:*:*","matchCriteriaId":"4F2433A7-3333-407D-8147-9AC736049590"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.4:*:*:*:*:*:*:*","matchCriteriaId":"585B9665-B422-418D-9AEC-65E65D24621B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.2.5:*:*:*:*:*:*:*","matchCriteriaId":"7DA2677B-1237-4D22-A51E-3A67B6AA9F9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:*:*:*:*:*:*:*","matchCriteriaId":"2D6642BE-13B4-40F8-BFD4-AD1E55B1A3BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:rc4:*:*:*:*:*:*","matchCriteriaId":"18962E5D-185E-4AF8-B0B3-11026B61053D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:rc5:*:*:*:*:*:*","matchCriteriaId":"2EBCE67F-34AC-4635-A2DF-E0C304FAB8E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3:rc7:*:*:*:*:*:*","matchCriteriaId":"197F9E88-DE20-44B5-B159-8E7BC3986E9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.1:*:*:*:*:*:*:*","matchCriteriaId":"3BF65B33-FD2F-4F2B-9F67-360F8957FABC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.2:*:*:*:*:*:*:*","matchCriteriaId":"3C668BD7-C4E3-4A12-9987-E565250E2E1F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.3:*:*:*:*:*:*:*","matchCriteriaId":"A3F93314-4F2D-4036-94F7-986B16BEC851"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.4:*:*:*:*:*:*:*","matchCriteriaId":"92A161E8-6CB8-40FF-9D90-00664185F69F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.5:*:*:*:*:*:*:*","matchCriteriaId":"B9533C06-96BF-4D5D-A29C-F2AD2EE5108C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.6:*:*:*:*:*:*:*","matchCriteriaId":"B20EFCED-EC50-4A9B-970B-E29CDBDAABDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.7:*:*:*:*:*:*:*","matchCriteriaId":"CCC5F7F8-EFC2-4FD0-A293-59F76EBFAE05"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.3.8:*:*:*:*:*:*:*","matchCriteriaId":"361F32F0-8009-40D2-BC14-74AE90CDB36C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:*:*:*:*:*:*:*","matchCriteriaId":"6B6E65D8-0D8E-4D11-82D7-DD3FB3EB1095"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc0:*:*:*:*:*:*","matchCriteriaId":"67535E99-5DD8-4F90-9DB1-5415201E94E2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc1:*:*:*:*:*:*","matchCriteriaId":"F3163CEC-C0D5-401E-93C3-6A5316630FC2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc1.1136.g2794:*:*:*:*:*:*","matchCriteriaId":"8DA19E8C-34DE-4721-88E2-B97774E855E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc2:*:*:*:*:*:*","matchCriteriaId":"ED57760D-0C08-43FE-A837-B00D271EDBA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc3:*:*:*:*:*:*","matchCriteriaId":"BA11029F-E4F7-4D4A-817C-A7CC5AD4E872"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc4:*:*:*:*:*:*","matchCriteriaId":"8A42B9B9-7B29-429D-9ABC-736CCC038813"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4:rc5:*:*:*:*:*:*","matchCriteriaId":"456AD412-970D-495E-8F7F-0CF670C364B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.1:*:*:*:*:*:*:*","matchCriteriaId":"63530521-E600-4326-B057-162E6635554B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.2:*:*:*:*:*:*:*","matchCriteriaId":"0715BCFB-5EAA-4812-BB59-7210CB6670FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.3:*:*:*:*:*:*:*","matchCriteriaId":"E9BBAA74-B0DE-4388-8C1B-8C3FF258EDD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.4:*:*:*:*:*:*:*","matchCriteriaId":"A8CEFC6C-0066-4331-A7A8-02047A19206A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.5:*:*:*:*:*:*:*","matchCriteriaId":"1337EA7C-3E52-47EC-8A32-C61A3B5046A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.6:*:*:*:*:*:*:*","matchCriteriaId":"D9D484DA-BCEA-4873-9F8C-883D702644F7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.4.7:*:*:*:*:*:*:*","matchCriteriaId":"BF45A2CE-0E19-477F-9393-B8AAD158D285"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:*:*:*:*:*:*:*","matchCriteriaId":"3095075A-5A99-4718-9E5E-56D442A14EAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:rc1:*:*:*:*:*:*","matchCriteriaId":"49D8DA6B-C306-455E-BAF1-0C5C2E1F33B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:rc2:*:*:*:*:*:*","matchCriteriaId":"6881163A-4097-4BAE-A84A-82D819BBF304"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5:rc3:*:*:*:*:*:*","matchCriteriaId":"BF31FA87-A8B8-46A1-8945-CB2613FE3B9A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.1:*:*:*:*:*:*:*","matchCriteriaId":"32E6B6B9-BD9A-4DF2-8DDC-B2A55431B3FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.2:*:*:*:*:*:*:*","matchCriteriaId":"0FA7D904-012D-448D-B1F6-885A472B8BCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.3:*:*:*:*:*:*:*","matchCriteriaId":"9C0605BA-481D-4E71-8D57-A99F8CDB7492"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.3:r1:*:*:*:*:*:*","matchCriteriaId":"FF740C26-5EB6-4184-93C3-DAC38F01CE25"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.4:*:*:*:*:*:*:*","matchCriteriaId":"668F528C-50BC-4944-9DC3-95D0413D2359"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.5:*:*:*:*:*:*:*","matchCriteriaId":"E3D715F7-34D2-4D1D-B49B-74AF4D7D7C55"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.5.6:*:*:*:*:*:*:*","matchCriteriaId":"6DF925DE-031A-451F-83A6-1B355D364358"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6:*:*:*:*:*:*:*","matchCriteriaId":"31BE5F63-902F-4326-B38B-96D692F86B7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.1:*:*:*:*:*:*:*","matchCriteriaId":"AECFAEA8-3B87-4BFE-98A3-58F5129D9BCF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.2:*:*:*:*:*:*:*","matchCriteriaId":"D6228681-1150-4B80-AFB0-451BAEB393A4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.3:*:*:*:*:*:*:*","matchCriteriaId":"E807BBE3-A2EC-4EA2-8222-7A02D03848D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.4:*:*:*:*:*:*:*","matchCriteriaId":"C7122491-D55D-451B-A2BC-D87D283A504E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.5:*:*:*:*:*:*:*","matchCriteriaId":"D6C7B6C0-BE57-44E3-AFEE-C4EF2A721ABB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.6:*:*:*:*:*:*:*","matchCriteriaId":"05F3F78A-C8A5-4F5C-89FA-418A88A8DBAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.6:rc0:*:*:*:*:*:*","matchCriteriaId":"F6DA2D48-4F72-4811-870A-4E2B99B4361E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.6:rc2:*:*:*:*:*:*","matchCriteriaId":"278CD0BC-81AC-4EEE-8437-2981F94B40B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.5.6.6:rc3:*:*:*:*:*:*","matchCriteriaId":"B9DAAE30-324D-4D36-AAA9-0DEA6F2A986E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0:*:*:*:*:*:*:*","matchCriteriaId":"8B8F4980-EC18-4DBA-8950-82F1B81FC008"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0:rc1:*:*:*:*:*:*","matchCriteriaId":"12C5DE96-2748-4A9F-A321-D6AD3091C3C4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0:rc2:*:*:*:*:*:*","matchCriteriaId":"B3E7D230-166E-434D-B425-01D6EC159A27"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0:rc3:*:*:*:*:*:*","matchCriteriaId":"3BDC47F7-47D6-4780-B637-BF646D522ABB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A600049E-2E7D-4A05-926B-C6A4F26496AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0.2:*:*:*:*:*:*:*","matchCriteriaId":"52406E96-C133-4EE9-BF80-D2327DFEFC10"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0.3:*:*:*:*:*:*:*","matchCriteriaId":"B08816A4-C2D8-40BE-BD46-D9A3A6BBED0F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0.4:*:*:*:*:*:*:*","matchCriteriaId":"BAEBEDEF-54BD-4974-AE96-ABCF85508379"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0.5:*:*:*:*:*:*:*","matchCriteriaId":"11EE6977-784D-49C9-A1EF-740F5225CF80"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.0.6:*:*:*:*:*:*:*","matchCriteriaId":"1237CF62-B0FC-463E-BD89-7CE4EA6BE04E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.1:*:*:*:*:*:*:*","matchCriteriaId":"4B271C19-57A4-4C55-93F6-D2E8DBB77227"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.1:rc1:*:*:*:*:*:*","matchCriteriaId":"3969527E-386C-4847-BE40-9248334F0CEC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.1:rc2:*:*:*:*:*:*","matchCriteriaId":"270B17C7-68D3-4EBE-B7FA-228EBF68AAA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.1:rc3:*:*:*:*:*:*","matchCriteriaId":"A1220F4F-68A2-45DC-A713-5E5623F09BF7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.1:rc4:*:*:*:*:*:*","matchCriteriaId":"DFECB8C5-534D-4795-A6E0-6918CFAC8F22"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.1.4:*:*:*:*:*:*:*","matchCriteriaId":"9B2A1CA7-7E39-4B44-9BE7-7CA2189FDE78"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2:*:*:*:*:*:*:*","matchCriteriaId":"B6CAC62E-587A-420E-BA87-1DD7521DE041"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2:rc1:*:*:*:*:*:*","matchCriteriaId":"DB9EF84C-AFDD-47F7-A4CF-9248F576AE13"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2.1:*:*:*:*:*:*:*","matchCriteriaId":"C103628E-6386-4FD1-9C9F-006C2A66D8C9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2.2:*:*:*:*:*:*:*","matchCriteriaId":"62E9E5D3-7409-47E3-8D80-6EEA07E75307"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2.3:*:*:*:*:*:*:*","matchCriteriaId":"8438B6E4-82D7-4802-967A-0B57A0FB3C94"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2.4:*:*:*:*:*:*:*","matchCriteriaId":"BEA315FC-51F6-4F3B-B5BE-65EC19C04C03"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.2.5:*:*:*:*:*:*:*","matchCriteriaId":"AE4C1753-6B09-48DB-86EF-FED3227775E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3:*:*:*:*:*:*:*","matchCriteriaId":"8B7B30E6-0CCC-4CD1-942C-E5D41F457A28"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3:rc1:*:*:*:*:*:*","matchCriteriaId":"2077E2D4-C924-4B9F-81C3-3415DC3A64B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3:rc2:*:*:*:*:*:*","matchCriteriaId":"6F118777-F3D1-4F3B-8708-E9A1DA26B09F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3:rc3:*:*:*:*:*:*","matchCriteriaId":"875D5BB6-4AEB-47C7-9E82-532BB917ADFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3:rc4:*:*:*:*:*:*","matchCriteriaId":"1194FF74-89D6-4D5A-A5A9-E13127978FE7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3.1:*:*:*:*:*:*:*","matchCriteriaId":"24B2004A-F5EB-4510-A60A-AD1C407CCB42"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.6.3.2:*:*:*:*:*:*:*","matchCriteriaId":"2DD783B5-72E2-4FE3-B5A3-0325E60BE2B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.2:*:*:*:*:*:*:*","matchCriteriaId":"DFB51853-9E04-42AA-AB94-16E2E6D3D1F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.2.1:*:*:*:*:*:*:*","matchCriteriaId":"0220FC4E-BA91-49AB-ACB3-D0A8B87080D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.2.2:*:*:*:*:*:*:*","matchCriteriaId":"46DB0325-9034-4396-B081-2E1F7E3C9A5E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.2.3:*:*:*:*:*:*:*","matchCriteriaId":"5FC201CA-D4DD-4C4F-BEA8-D109161D1DDA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.2.4:*:*:*:*:*:*:*","matchCriteriaId":"6A4AC6B5-B26F-4C1B-A438-677966151381"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.2.5:*:*:*:*:*:*:*","matchCriteriaId":"FA3C698E-FF63-4818-9405-7860A3ED7B03"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.3:*:*:*:*:*:*:*","matchCriteriaId":"8A1A3E28-1000-49DD-BE1F-78AFD10BC1B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.3.1:*:*:*:*:*:*:*","matchCriteriaId":"2D4F9DED-744C-4557-A78C-9F741115A330"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:1.7.3.2:*:*:*:*:*:*:*","matchCriteriaId":"1CDD64A3-C3FD-4D63-A565-E82B62390CED"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"1.7.3.3","matchCriteriaId":"18FDECCF-7932-484F-B3D0-AE5C7F2DF00B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.01:*:*:*:*:*:*:*","matchCriteriaId":"26F49181-20C5-4B6A-B733-9995913287CE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.02:*:*:*:*:*:*:*","matchCriteriaId":"90407B83-D91F-4774-8197-2E7A8DB9635B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.03:*:*:*:*:*:*:*","matchCriteriaId":"72ED95C7-2223-4C55-90F7-14F2BF8E9A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.04:*:*:*:*:*:*:*","matchCriteriaId":"8651F8C8-98E9-4EBF-8D6B-D9F5FAE67381"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.5:*:*:*:*:*:*:*","matchCriteriaId":"94EBAFE1-A7BF-4EF6-8E5B-1547792161EB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.6.0:*:*:*:*:*:*:*","matchCriteriaId":"FFB286E1-525B-43B1-8940-0986854BE595"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:0.7.0:*:*:*:*:*:*:*","matchCriteriaId":"398057EC-27A8-4A84-A01D-E14EEB496A7F"}]}]}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052518.html","source":"security@ubuntu.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052782.html","source":"security@ubuntu.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html","source":"security@ubuntu.com"},{"url":"http://secunia.com/advisories/42645","source":"security@ubuntu.com","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42731","source":"security@ubuntu.com"},{"url":"http://secunia.com/advisories/42743","source":"security@ubuntu.com"},{"url":"http://secunia.com/advisories/43457","source":"security@ubuntu.com"},{"url":"http://www.exploit-db.com/exploits/15744","source":"security@ubuntu.com","tags":["Exploit"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:256","source":"security@ubuntu.com"},{"url":"http://www.redhat.com/support/errata/RHSA-2010-1003.html","source":"security@ubuntu.com"},{"url":"http://www.securityfocus.com/bid/45439","source":"security@ubuntu.com","tags":["Exploit"]},{"url":"http://www.securitytracker.com/id?1024905","source":"security@ubuntu.com"},{"url":"http://www.vupen.com/english/advisories/2010/3323","source":"security@ubuntu.com"},{"url":"http://www.vupen.com/english/advisories/2011/0010","source":"security@ubuntu.com"},{"url":"http://www.vupen.com/english/advisories/2011/0464","source":"security@ubuntu.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052518.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052782.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/42645","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42731","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/42743","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/43457","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/15744","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:256","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.redhat.com/support/errata/RHSA-2010-1003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/45439","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.securitytracker.com/id?1024905","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2010/3323","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2011/0010","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2011/0464","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-0308","sourceIdentifier":"secalert@redhat.com","published":"2013-03-08T21:55:03.170","lastModified":"2026-06-16T23:49:10.010","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."},{"lang":"es","value":"El comando imap-send en GIT antes de v1.8.1.4 no comprueba si el nombre del servidor coincide con un nombre de dominio en el nombre común del sujeto (CN) o el campo subjectAltName del certificado X.509, lo que permite atacantes MITM (Man-In-The-Middle) suplantar servidores SSL de su elección a través de un certificado válido.\r\n"}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.1.3","matchCriteriaId":"0B3F5077-5074-47E0-9C63-67A4C6ECB1DB"}]}]}],"references":[{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586","source":"secalert@redhat.com"},{"url":"http://lists.apple.com/archives/security-announce/2013/Sep/msg00007.html","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00005.html","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00007.html","source":"secalert@redhat.com"},{"url":"http://marc.info/?l=git&m=136134619013145&w=2","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0589.html","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/52361","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/52443","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/52467","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://support.apple.com/kb/HT5937","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/58148","source":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1028205","source":"secalert@redhat.com"},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=804730","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909977","source":"secalert@redhat.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82329","source":"secalert@redhat.com"},{"url":"https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt","source":"secalert@redhat.com"},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.apple.com/archives/security-announce/2013/Sep/msg00007.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00005.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00007.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=git&m=136134619013145&w=2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0589.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/52361","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/52443","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/52467","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://support.apple.com/kb/HT5937","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/58148","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1028205","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=804730","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909977","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82329","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2016-2315","sourceIdentifier":"cve@mitre.org","published":"2016-04-08T14:59:01.187","lastModified":"2026-06-17T00:43:48.567","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow."},{"lang":"es","value":"revision.c en git en versiones anteriores a 2.7.4 utiliza un tipo de datos de entero incorrecto, lo que permite a atacantes remotos ejecutar código arbitrario a través de un (1) nombre de archivo grande o (2) muchos árboles anidados, dando lugar a un desbordamiento de buffer basado en memoria dinámica."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*","matchCriteriaId":"F892F1B0-514C-42F7-90AE-12ACDFDC1033"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*","matchCriteriaId":"BD6136E8-74DE-48AF-A8AB-B0E93D34870C"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*","matchCriteriaId":"4863BE36-D16A-4D75-90D9-FD76DB5B48B7"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*","matchCriteriaId":"03117DF1-3BEC-4B8D-AD63-DBBDB2126081"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*","matchCriteriaId":"2076747F-A98E-4DD9-9B52-BF1732BCAD3D"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*","matchCriteriaId":"D41A798E-0D69-43C7-9A63-1E5921138EAC"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*","matchCriteriaId":"DB2A1559-651C-46B0-B436-8E03DC8A60D2"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*","matchCriteriaId":"5A633996-2FD7-467C-BAA6-529E16BD06D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*","matchCriteriaId":"9C649194-B8C2-49F7-A819-C635EE584ABF"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.7.3:*:*:*:*:*:*:*","matchCriteriaId":"F90A339F-A701-4669-9873-EC386D32560B"}]}]}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html","source":"cve@mitre.org","tags":["Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://pastebin.com/UX2P2jjg","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3521","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/15/5","source":"cve@mitre.org","tags":["Mailing List"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/84355","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035290","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2938-1","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201605-01","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://pastebin.com/UX2P2jjg","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3521","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/15/5","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/84355","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035290","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2938-1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201605-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2016-2324","sourceIdentifier":"cve@mitre.org","published":"2016-04-08T14:59:02.313","lastModified":"2026-06-17T00:43:49.310","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow."},{"lang":"es","value":"Desboradmiento de entero en Git en versiones anteriores a 2.7.4 permite a atacantes remotos ejecutar código arbitrario a través de un (1) nombre de archivo grande o (2) muchos árboles anidados, lo que desencadena un desbordamiento de buffer basado en memoria dinámica."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*","matchCriteriaId":"F892F1B0-514C-42F7-90AE-12ACDFDC1033"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*","matchCriteriaId":"BD6136E8-74DE-48AF-A8AB-B0E93D34870C"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*","matchCriteriaId":"4863BE36-D16A-4D75-90D9-FD76DB5B48B7"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*","matchCriteriaId":"03117DF1-3BEC-4B8D-AD63-DBBDB2126081"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12.0:sp1:*:*:*:*:*:*","matchCriteriaId":"0D26C097-6610-4188-8743-AF073A850915"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*","matchCriteriaId":"D41A798E-0D69-43C7-9A63-1E5921138EAC"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*","matchCriteriaId":"DB2A1559-651C-46B0-B436-8E03DC8A60D2"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*","matchCriteriaId":"A6D8A2AD-7C99-4665-A1BB-C0D74F79BFBD"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*","matchCriteriaId":"9C649194-B8C2-49F7-A819-C635EE584ABF"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.7.3","matchCriteriaId":"E0F5E4BC-D015-47CF-A3F8-2444259845B4"}]}]}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://pastebin.com/UX2P2jjg","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3521","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/15/5","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/84355","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035290","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2938-1","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201605-01","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"http://pastebin.com/UX2P2jjg","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3521","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/15/5","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/84355","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035290","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2938-1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201605-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2014-9938","sourceIdentifier":"cve@mitre.org","published":"2017-03-20T00:59:00.160","lastModified":"2026-06-17T00:19:16.610","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution."},{"lang":"es","value":"Contrib/completion/git-prompt.sh en Git en versiones anteriores a 1.9.3 no desinfecta nombres de sucursales en la variable PS1, permitiendo que un repositorio malicioso cause la ejecución de código."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-116"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"1.9.3","matchCriteriaId":"D67E3C48-DF06-493E-8611-16DE842FE68A"}]}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2004","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/njhartwell/pw3nage","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2004","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/njhartwell/pw3nage","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-14867","sourceIdentifier":"cve@mitre.org","published":"2017-09-29T01:34:50.047","lastModified":"2026-06-17T01:06:53.583","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support."},{"lang":"es","value":"Git en versiones anteriores a la 2.10.5, las versiones 2.11.x anteriores a 2.11.4, las 2.12.x anteriores a2.12.5, las 2.13.x anteriores a 2.13.6 y las 2.14.x anteriores a 2.14.2 emplean scripts de Perl no seguros para dar soporte a subcomandos como cvsserver. Esto permite que los atacantes ejecuten comandos arbitrarios del sistema operativo mediante metacaracteres shell en un nombre de módulo. El código vulnerable puede alcanzarse mediante git-shell incluso sin soporte para CVS."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.10.4","matchCriteriaId":"869803A7-F867-498B-AE64-424EE475E890"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*","matchCriteriaId":"B97E04C0-465C-4A2D-8FD5-FC75094E3736"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*","matchCriteriaId":"4EA24D16-84C8-4DF6-B4E1-288A3C991518"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*","matchCriteriaId":"FAA9C323-AEAA-4A55-849B-B0E731709AD6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.3:*:*:*:*:*:*:*","matchCriteriaId":"301975E7-A398-49F1-BC07-5D72643C16D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"F9CAC635-62EE-49EC-A5AA-5B4D8A1C6AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*","matchCriteriaId":"79BF6D70-E21E-4E47-A41E-C063659A7786"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*","matchCriteriaId":"5EDA604D-2901-4AF2-9411-80681B445F19"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*","matchCriteriaId":"A6EC96D3-BD11-4E2A-9E7B-276F4311EF54"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.4:*:*:*:*:*:*:*","matchCriteriaId":"58C65FA3-5BA4-40E5-A0C3-38E464A60D05"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*","matchCriteriaId":"5EE0CA61-E0C2-432C-9095-DEDC2DDA32E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*","matchCriteriaId":"5CF7CD32-A6BB-474A-A356-C2BFBBE9910A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*","matchCriteriaId":"A6945B1B-75CF-42F5-A93E-D077CA1ED9E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*","matchCriteriaId":"0D3A3F02-578A-4C96-B0A8-AED9204B8872"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*","matchCriteriaId":"17B08345-AE7F-4130-AD09-A5BA2F2C2F71"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.5:*:*:*:*:*:*:*","matchCriteriaId":"D69295DA-2E14-4FF3-8778-7650B20A75B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*","matchCriteriaId":"75FFDA48-13E9-4918-BA44-EE3BCF670B31"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.14.1:*:*:*:*:*:*:*","matchCriteriaId":"75FDC16B-61FD-4D08-8EBF-D0DAB07079BC"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/09/26/9","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/101060","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039431","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://bugs.debian.org/876854","source":"cve@mitre.org","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00246.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2017/dsa-3984","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/09/26/9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/101060","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039431","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://bugs.debian.org/876854","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00246.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2017/dsa-3984","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-1000117","sourceIdentifier":"cve@mitre.org","published":"2017-10-05T01:29:04.650","lastModified":"2026-06-17T00:58:46.300","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious third-party can give a crafted \"ssh://...\" URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running \"git clone --recurse-submodules\" to trigger the vulnerability."},{"lang":"es","value":"Un tercero malicioso puede proporcionar una URL \"ssh://...\" manipulada a una víctima desprevenida y un intento de visita a la URL puede resultar en que se ejecute cualquier programa que exista en la máquina de la víctima. Dicha URL podría colocarse en el archivo .gitmodules de un proyecto malicioso y una víctima desprevenida podría ser engañada para que ejecute \"git clone --recurse-submodules\" para desencadenar esta vulnerabilidad."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.7.5","matchCriteriaId":"84CB932E-3257-479A-B954-04E7FE3492AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.0:*:*:*:*:*:*:*","matchCriteriaId":"9896397E-782E-4DFE-827F-B90B6B03180F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.0:rc0:*:*:*:*:*:*","matchCriteriaId":"724E4EFF-3852-4393-BA02-C539931086AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2029A919-F374-4BBD-9600-39CF3362FF53"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.0:rc2:*:*:*:*:*:*","matchCriteriaId":"AFBFE569-7A79-4DA2-A0D5-692F8979586D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.0:rc3:*:*:*:*:*:*","matchCriteriaId":"BEFB1D30-65A7-41AF-90EB-724DC43E863E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.1:*:*:*:*:*:*:*","matchCriteriaId":"723F9CFF-5DF8-4C67-BB1B-8D466BFBBD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.2:*:*:*:*:*:*:*","matchCriteriaId":"09AD7972-8B47-46B3-BA30-B231BEE61CC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.3:*:*:*:*:*:*:*","matchCriteriaId":"A10D5AB3-4282-446D-BCA7-478E1E8BD023"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.4:*:*:*:*:*:*:*","matchCriteriaId":"EB7F6D0D-28C2-47FD-B558-AFD1EE62892C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.8.5:*:*:*:*:*:*:*","matchCriteriaId":"498161A8-6E94-4B87-9501-A350832CE537"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.0:*:*:*:*:*:*:*","matchCriteriaId":"7A07BE55-D467-49CE-8450-80033A620065"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.0:rc0:*:*:*:*:*:*","matchCriteriaId":"584B9BC8-5780-467F-BEA8-4629179EF512"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.0:rc1:*:*:*:*:*:*","matchCriteriaId":"BF4ED0D4-8845-4D9B-8FDD-9C5B0669820F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.0:rc2:*:*:*:*:*:*","matchCriteriaId":"498C3970-FD12-4DE7-8B29-F1A523411CA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.1:*:*:*:*:*:*:*","matchCriteriaId":"2F564229-0A0E-4C3D-A78A-000DCB0160EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.2:*:*:*:*:*:*:*","matchCriteriaId":"E7595ECD-7BFD-4581-A995-FEE5E5217CDD"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.3:*:*:*:*:*:*:*","matchCriteriaId":"1F75D4CF-A398-4E01-829D-C940C6332B10"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.9.4:*:*:*:*:*:*:*","matchCriteriaId":"F4A5029C-C798-4D78-B3B7-D05B58EEE9AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.0:*:*:*:*:*:*:*","matchCriteriaId":"FB2EE715-5F6B-4418-B126-2B4479A6AACE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.0:rc0:*:*:*:*:*:*","matchCriteriaId":"9F01B79C-94C3-4612-A75A-916B21A908C9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.0:rc1:*:*:*:*:*:*","matchCriteriaId":"01432EC1-B91A-435C-A678-1095C1B05C96"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.0:rc2:*:*:*:*:*:*","matchCriteriaId":"F15B4DD5-820D-4B20-8C05-63C29DBC442B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.1:*:*:*:*:*:*:*","matchCriteriaId":"C3AFD4F3-99A3-40A2-A479-F3B2EAAD5106"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.2:*:*:*:*:*:*:*","matchCriteriaId":"1F0CFE5D-8865-4D6A-A170-54C23BA3D29C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.10.3:*:*:*:*:*:*:*","matchCriteriaId":"303F3C6A-2603-4B1B-9122-7B0E53EB0550"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*","matchCriteriaId":"B97E04C0-465C-4A2D-8FD5-FC75094E3736"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.0:rc0:*:*:*:*:*:*","matchCriteriaId":"EB78402D-3DCA-48DE-838F-89C89361D8F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.0:rc1:*:*:*:*:*:*","matchCriteriaId":"5F3C8084-7FEA-427C-9948-75DAC2914006"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.0:rc2:*:*:*:*:*:*","matchCriteriaId":"E8743E90-7C05-4656-B758-36052C926925"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F79B3A03-B0A5-4A00-A7A8-332D8ACB3799"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*","matchCriteriaId":"4EA24D16-84C8-4DF6-B4E1-288A3C991518"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*","matchCriteriaId":"FAA9C323-AEAA-4A55-849B-B0E731709AD6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"F9CAC635-62EE-49EC-A5AA-5B4D8A1C6AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.0:rc0:*:*:*:*:*:*","matchCriteriaId":"BB756061-0242-48DE-B784-0868703B1CE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.0:rc1:*:*:*:*:*:*","matchCriteriaId":"8DE21911-882D-4718-9808-05DDB50C9143"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.0:rc2:*:*:*:*:*:*","matchCriteriaId":"2F34AACB-1089-47E1-9BA7-DFD80B716552"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*","matchCriteriaId":"79BF6D70-E21E-4E47-A41E-C063659A7786"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*","matchCriteriaId":"5EDA604D-2901-4AF2-9411-80681B445F19"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*","matchCriteriaId":"A6EC96D3-BD11-4E2A-9E7B-276F4311EF54"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*","matchCriteriaId":"5EE0CA61-E0C2-432C-9095-DEDC2DDA32E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.0:rc0:*:*:*:*:*:*","matchCriteriaId":"2580E25C-EF78-4DAD-8EEB-E35BD584DD5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.0:rc1:*:*:*:*:*:*","matchCriteriaId":"7C879263-ACFB-429C-A8ED-22CDE21AF993"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.0:rc2:*:*:*:*:*:*","matchCriteriaId":"658946E0-1DC0-4911-B92A-167D5CD284AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*","matchCriteriaId":"5CF7CD32-A6BB-474A-A356-C2BFBBE9910A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*","matchCriteriaId":"A6945B1B-75CF-42F5-A93E-D077CA1ED9E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*","matchCriteriaId":"0D3A3F02-578A-4C96-B0A8-AED9204B8872"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*","matchCriteriaId":"17B08345-AE7F-4130-AD09-A5BA2F2C2F71"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*","matchCriteriaId":"75FFDA48-13E9-4918-BA44-EE3BCF670B31"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.14.0:rc0:*:*:*:*:*:*","matchCriteriaId":"1B7828B4-C9D5-4F30-B03E-1A2584F270DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.14.0:rc1:*:*:*:*:*:*","matchCriteriaId":"5AE005D5-216B-4266-ABE4-265B66B65F86"}]}]}],"references":[{"url":"http://www.debian.org/security/2017/dsa-3934","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/100283","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039131","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2484","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:2485","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:2491","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:2674","source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:2675","source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201709-10","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://support.apple.com/HT208103","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42599/","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html","source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2017/dsa-3934","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/100283","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039131","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2484","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2485","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2491","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2674","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2675","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201709-10","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://support.apple.com/HT208103","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42599/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2017-15298","sourceIdentifier":"cve@mitre.org","published":"2017-10-14T22:29:00.200","lastModified":"2026-06-17T01:07:32.697","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk."},{"lang":"es","value":"Git, en versiones hasta la 2.14.2 gestiona de manera incorrecta capas de objetos tipo árbol, lo que permite que atacantes remotos provoquen una denegación de servicio (consumo de memoria) mediante un repositorio manipulado. Esto también se conoce como bombas Git (Git bomb). Esto también puede causar un impacto de consumo de disco; sin embargo, un proceso afectado normalmente no sobreviviría a este intento de construir la estructura de datos en la memoria antes de escribir en el disco."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.14.2","matchCriteriaId":"B122112C-041C-4E35-A95B-09A6FEB34E66"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*","matchCriteriaId":"07C312A0-CD2C-4B9C-B064-6409B25C278F"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"cve@mitre.org"},{"url":"https://github.com/Katee/git-bomb","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://kate.io/blog/git-bomb/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3829-1/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Katee/git-bomb","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://kate.io/blog/git-bomb/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3829-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-1000021","sourceIdentifier":"cve@mitre.org","published":"2018-02-09T23:29:00.557","lastModified":"2026-06-17T01:32:13.420","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack)."},{"lang":"es","value":"GIT, en versiones 2.15.1 y anteriores, contiene una vulnerabilidad de error de validación de entradas en Client que puede resultar en problemas que incluyen errores de configuración de terminal en RCE. Parece ser que este ataque puede ser explotado mediante un usuario que interactúe con un servidor git malicioso (o que haga que el tráfico se modifique en un ataque MITM)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":3.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.15.1","matchCriteriaId":"558FC963-17F8-4158-8B3B-1F975D6E3902"}]}]}],"references":[{"url":"http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-11233","sourceIdentifier":"cve@mitre.org","published":"2018-05-30T04:29:00.207","lastModified":"2026-06-17T01:35:33.000","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory."},{"lang":"es","value":"En Git, en versiones anteriores a la 2.13.7, versiones 2.14.x anteriores a la 2.14.4, versiones 2.15.x anteriores a la 2.15.2, versiones 2.16.x anteriores a la 2.16.4 y versiones 2.17.x anteriores a la 2.17.1, el código para comprobar el saneamiento de los nombres de ruta en NTFS puede resultar en la lectura de memoria fuera de límites."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","matchCriteriaId":"9070C9D8-A14A-467F-8253-33B966C16886"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.13.6","matchCriteriaId":"CE96C42E-1DF2-4CC6-AB37-C8122905B5D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.14.0","versionEndIncluding":"2.14.3","matchCriteriaId":"515402E8-CC8F-4B78-9885-AD23C6FFCD8C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.15.0","versionEndIncluding":"2.15.1","matchCriteriaId":"66B7E411-4448-45CA-8F65-A78AF2BE411C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndIncluding":"2.16.3","matchCriteriaId":"BC4924B8-5B90-426E-B534-F2D96C807F1D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.17.0:*:*:*:*:*:*:*","matchCriteriaId":"2D9CD326-3B81-4DBA-AB43-7FD2B596D411"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/104346","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040991","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2147","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://marc.info/?l=git&m=152761328506724&w=2","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201805-13","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3671-1/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/104346","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040991","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2147","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://marc.info/?l=git&m=152761328506724&w=2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201805-13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3671-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-11235","sourceIdentifier":"cve@mitre.org","published":"2018-05-30T04:29:00.287","lastModified":"2026-06-17T01:35:33.150","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."},{"lang":"es","value":"En Git, en versiones anteriores a la 2.13.7, versiones 2.14.x anteriores a la 2.14.4, versiones 2.15.x anteriores a la 2.15.2, versiones 2.16.x anteriores a la 2.16.4 y versiones 2.17.x anteriores a la 2.17.1, puede ocurrir una ejecución remota de código. Con un archivo .gitmodules manipulado, un proyecto malicioso puede ejecutar un script arbitrario en una máquina que ejecuta \"git clone --recurse-submodules\" debido a que se obtienen \"nombres\" de subdominios de este archivo y luego se anexa a $GIT_DIR/modules, lo que conduce a un salto de directorio con \"../\" en un nombre. Finalmente, se ejecutan hooks post-checkout de un submódulo, omitiendo el diseño planeado en el que no se obtienen hooks de un servidor remoto."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","matchCriteriaId":"9070C9D8-A14A-467F-8253-33B966C16886"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","matchCriteriaId":"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.13.6","matchCriteriaId":"CE96C42E-1DF2-4CC6-AB37-C8122905B5D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.14.0","versionEndIncluding":"2.14.3","matchCriteriaId":"515402E8-CC8F-4B78-9885-AD23C6FFCD8C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.15.0","versionEndIncluding":"2.15.1","matchCriteriaId":"66B7E411-4448-45CA-8F65-A78AF2BE411C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndIncluding":"2.16.3","matchCriteriaId":"BC4924B8-5B90-426E-B534-F2D96C807F1D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.17.0:*:*:*:*:*:*:*","matchCriteriaId":"2D9CD326-3B81-4DBA-AB43-7FD2B596D411"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitforwindows:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.17.1","matchCriteriaId":"5F7B7974-49D2-46EA-940E-A3056C94FD41"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/104345","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040991","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1957","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2147","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","source":"cve@mitre.org","tags":["Patch","Technical Description","Vendor Advisory"]},{"url":"https://marc.info/?l=git&m=152761328506724&w=2","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201805-13","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3671-1/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4212","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44822/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/104345","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040991","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1957","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2147","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Technical Description","Vendor Advisory"]},{"url":"https://marc.info/?l=git&m=152761328506724&w=2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201805-13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3671-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4212","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44822/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2018-17456","sourceIdentifier":"cve@mitre.org","published":"2018-10-06T14:29:00.300","lastModified":"2026-06-17T01:45:53.027","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."},{"lang":"es","value":"Git en versiones anteriores a la 2.14.5, versiones 2.15.x anteriores a la 2.15.3, versiones 2.16.x anteriores a la 2.16.5, versiones 2.17.x anteriores a la 2.17.2, versiones 2.18.x anteriores a la 2.18.1 y versiones 2.19.x anteriores a la 2.19.1 permite la ejecución remota de código durante el procesamiento de un \"clon de git\" recursivo de un superproyecto si un archivo .gitmodules tiene un campo URL que comienza por un carácter \"-\"."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-88"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.14.0","versionEndExcluding":"2.14.5","matchCriteriaId":"ED8DE6FB-46B5-4C26-BE2F-55B171323C5E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.15.0","versionEndExcluding":"2.15.3","matchCriteriaId":"58AFD1CE-ADE0-4051-B106-47B441FF267E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndExcluding":"2.16.5","matchCriteriaId":"40076AA1-1157-4A18-AF07-D1162A88B715"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.17.0","versionEndExcluding":"2.17.2","matchCriteriaId":"D51CF0E9-66B6-44BC-97A0-BDEDA2D82F8A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.1","matchCriteriaId":"606CCC22-495F-4938-BFA7-30DA28AE0D8B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.1","matchCriteriaId":"A96BE1EC-5270-4701-AEFB-7B038E204101"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*","matchCriteriaId":"A5319543-0143-4E2E-AA77-B7F116C1336C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*","matchCriteriaId":"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*","matchCriteriaId":"84FF61DF-D634-4FB5-8DF1-01F631BE1A7A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*","matchCriteriaId":"B99A2411-7F6A-457F-A7BF-EB13C630F902"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*","matchCriteriaId":"041F9200-4C01-4187-AE34-240E8277B54D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*","matchCriteriaId":"4EB48767-F095-444F-9E05-D9AC345AB803"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*","matchCriteriaId":"5F6FA12B-504C-4DBF-A32E-0548557AA2ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","matchCriteriaId":"33C068A4-3780-4EAB-A937-6082DF847564"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"51EF4996-72F4-4FA4-814F-F5991E7A8318"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B353CE99-D57C-465B-AAB0-73EF581127D1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"BF77CDCF-B9C9-427D-B2BF-36650FB2148C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","matchCriteriaId":"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","matchCriteriaId":"825ECE2D-E232-46E0-A047-074B34DB1E97"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/105523","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/107511","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041811","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3408","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3541","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0316","source":"cve@mitre.org"},{"url":"https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://marc.info/?l=git&m=153875888916397&w=2","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Mar/30","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3791-1/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4311","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/45548/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45631/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.openwall.com/lists/oss-security/2018/10/06/3","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/105523","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/107511","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041811","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3408","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3541","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0316","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://marc.info/?l=git&m=153875888916397&w=2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Mar/30","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3791-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4311","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/45548/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45631/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.openwall.com/lists/oss-security/2018/10/06/3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-19486","sourceIdentifier":"cve@mitre.org","published":"2018-11-23T08:29:00.263","lastModified":"2026-06-17T01:49:22.043","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017."},{"lang":"es","value":"Git, en versiones anteriores a la 2.19.2 en Linux y UNIX, ejecuta comandos desde el directorio de trabajo actual (como si '.' estuviera al final de $PATH) en determinados casos relacionados con la API run_command() y run-command.c, debido a un cambio peligroso desde execvp hasta execv en el 2017."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-426"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.19.2","matchCriteriaId":"C522E8A8-87F2-4062-83A7-8467A9ECC875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*","matchCriteriaId":"07C312A0-CD2C-4B9C-B064-6409B25C278F"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/106020","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1042166","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3800","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60","source":"cve@mitre.org","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201904-13","source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3829-1/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106020","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1042166","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3800","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201904-13","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3829-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-19604","sourceIdentifier":"cve@mitre.org","published":"2019-12-11T00:15:13.260","lastModified":"2026-06-17T02:26:56.033","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a \"git submodule update\" operation can run commands found in the .gitmodules file of a malicious repository."},{"lang":"es","value":"Una ejecución de comandos arbitrarios es posible en Git versiones anteriores a 2.20.2, versiones 2.21.x anteriores a 2.21.1, versiones 2.22.x anteriores a 2.22.2, versiones 2.23.x anteriores a 2.23.1 y versiones 2.24.x anteriores a 2.24.1, porque una operación \"git submodule update\" puede ejecutar comandos encontrados en el archivo .gitmodules de un repositorio malicioso."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.20.0","matchCriteriaId":"539A3B25-6523-4357-8B86-EC679711F48B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.21.0","versionEndExcluding":"2.21.1","matchCriteriaId":"4392299F-8DFB-4ADF-BAA8-4415D459E8EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.2","matchCriteriaId":"025C10E9-40A6-408C-AE2C-5FC55E788775"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.23.0","versionEndExcluding":"2.23.1","matchCriteriaId":"C9073ABE-276B-4301-B39C-B9BB6C1AA681"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.24.0","versionEndExcluding":"2.24.1","matchCriteriaId":"B6D58347-1CE3-4AEA-9617-2F46CCBE167E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","matchCriteriaId":"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","matchCriteriaId":"80F0FA5D-8D3B-4C0E-81E2-87998286AF33"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/12/13/1","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/","source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","source":"cve@mitre.org"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202003-30","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4581","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/12/13/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202003-30","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4581","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-1387","sourceIdentifier":"secure@microsoft.com","published":"2019-12-18T21:15:13.820","lastModified":"2026-06-17T02:28:30.630","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones."},{"lang":"es","value":"Se encontró un problema en Git versiones anteriores a v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4 y v2. 14.6. Los clones recursivos están actualmente afectados por una vulnerabilidad causada por una comprobación too-lax de los nombres de submódulos, permitiendo ataques muy específicos por medio de una ejecución de código remota en clones recursivos."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft Corporation","product":"Git","versions":[{"version":"Before v2.24.1","status":"affected"},{"version":"Before v2.23.1","status":"affected"},{"version":"Before v2.22.2","status":"affected"},{"version":"Before v2.21.1","status":"affected"},{"version":"Before v2.20.2","status":"affected"},{"version":"Before v2.19.3","status":"affected"},{"version":"Before v2.18.2","status":"affected"},{"version":"Before v2.17.3","status":"affected"},{"version":"Before v2.16.6","status":"affected"},{"version":"Before v2.15.4","status":"affected"},{"version":"Before v2.14.6","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"2,24.1","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.23.1","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.22.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.21.1","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.20.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.19.3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.18.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.17.3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.16.6","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.15.4","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2.14.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-19T18:49:36.663475Z","id":"CVE-2019-1387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.14.0","versionEndExcluding":"2.14.6","matchCriteriaId":"CD0FE176-63B7-4176-8319-80CD3D7C524E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.15.0","versionEndExcluding":"2.15.4","matchCriteriaId":"7FA79B4D-1A29-4520-ACF7-BBD5B2696ABA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndExcluding":"2.16.6","matchCriteriaId":"DB018182-B15F-47BC-85FA-6847BB37844A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.17.0","versionEndExcluding":"2.17.3","matchCriteriaId":"19CF821B-9ECC-4F6C-B0BC-7361370776C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.2","matchCriteriaId":"84278A89-0D1B-4CFD-9B31-68D8D7327E65"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.3","matchCriteriaId":"7B4FA857-692C-4C00-A170-1F31E6D9563E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.20.0","versionEndExcluding":"2.20.2","matchCriteriaId":"BD4C8899-C9E7-4DFC-BE17-D5D67B9B5FFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.2","matchCriteriaId":"025C10E9-40A6-408C-AE2C-5FC55E788775"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.21.0:*:*:*:*:*:*:*","matchCriteriaId":"A2FDF378-11FC-414D-8F4B-04BE6269C49A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.23.0:*:*:*:*:*:*:*","matchCriteriaId":"018467BF-01DC-40EE-99F4-0E8375A615DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.24.0:*:*:*:*:*:*:*","matchCriteriaId":"B977B43D-A0F8-4367-8BA4-96C12CF10002"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"secure@microsoft.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"secure@microsoft.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:4356","source":"secure@microsoft.com","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0002","source":"secure@microsoft.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0124","source":"secure@microsoft.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0228","source":"secure@microsoft.com"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html","source":"secure@microsoft.com"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"secure@microsoft.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","source":"secure@microsoft.com"},{"url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","source":"secure@microsoft.com"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"secure@microsoft.com"},{"url":"https://security.gentoo.org/glsa/202003-30","source":"secure@microsoft.com"},{"url":"https://security.gentoo.org/glsa/202003-42","source":"secure@microsoft.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:4356","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0002","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0124","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0228","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-30","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-42","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-1348","sourceIdentifier":"secure@microsoft.com","published":"2020-01-24T22:15:19.190","lastModified":"2026-06-17T02:28:26.050","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths."},{"lang":"es","value":"Se encontró un problema en Git anterior a la versión  v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4 y v2. 14.6 La opción --export-marks de git fast-import también se expone a través de la función de comando in-stream export-marks = ... y permite sobrescribir rutas arbitrarias"}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft Corporation","product":"Git","versions":[{"version":"Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:P/A:P","baseScore":3.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.14.0","versionEndExcluding":"2.14.6","matchCriteriaId":"CD0FE176-63B7-4176-8319-80CD3D7C524E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.15.0","versionEndExcluding":"2.15.4","matchCriteriaId":"7FA79B4D-1A29-4520-ACF7-BBD5B2696ABA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndExcluding":"2.16.6","matchCriteriaId":"DB018182-B15F-47BC-85FA-6847BB37844A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.17.0","versionEndExcluding":"2.17.3","matchCriteriaId":"19CF821B-9ECC-4F6C-B0BC-7361370776C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.2","matchCriteriaId":"84278A89-0D1B-4CFD-9B31-68D8D7327E65"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.3","matchCriteriaId":"7B4FA857-692C-4C00-A170-1F31E6D9563E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.20.0","versionEndExcluding":"2.20.2","matchCriteriaId":"BD4C8899-C9E7-4DFC-BE17-D5D67B9B5FFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.21.0","versionEndExcluding":"2.21.1","matchCriteriaId":"4392299F-8DFB-4ADF-BAA8-4415D459E8EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.2","matchCriteriaId":"025C10E9-40A6-408C-AE2C-5FC55E788775"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.23.0","versionEndExcluding":"2.23.1","matchCriteriaId":"C9073ABE-276B-4301-B39C-B9BB6C1AA681"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.24.0","versionEndExcluding":"2.24.1","matchCriteriaId":"B6D58347-1CE3-4AEA-9617-2F46CCBE167E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"secure@microsoft.com","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"secure@microsoft.com"},{"url":"https://access.redhat.com/errata/RHSA-2020:0228","source":"secure@microsoft.com","tags":["Third Party Advisory"]},{"url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","source":"secure@microsoft.com"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"secure@microsoft.com"},{"url":"https://security.gentoo.org/glsa/202003-30","source":"secure@microsoft.com"},{"url":"https://security.gentoo.org/glsa/202003-42","source":"secure@microsoft.com"},{"url":"https://support.apple.com/kb/HT210729","source":"secure@microsoft.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0228","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-30","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-42","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT210729","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-1353","sourceIdentifier":"secure@microsoft.com","published":"2020-01-24T22:15:19.253","lastModified":"2026-06-17T02:28:26.693","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active."},{"lang":"es","value":"El controlador IEC870IP para Vijeo Citect y Citect SCADA de AVENA y Power SCADA Operation de Schneider Electric, presenta una vulnerabilidad de desbordamiento de búfer que podría resultar en un bloqueo del lado del servidor."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft Corporation","product":"Git","versions":[{"version":"Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.14.0","versionEndExcluding":"2.14.6","matchCriteriaId":"CD0FE176-63B7-4176-8319-80CD3D7C524E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.15.0","versionEndExcluding":"2.15.4","matchCriteriaId":"7FA79B4D-1A29-4520-ACF7-BBD5B2696ABA"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndExcluding":"2.16.6","matchCriteriaId":"DB018182-B15F-47BC-85FA-6847BB37844A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.17.0","versionEndExcluding":"2.17.3","matchCriteriaId":"19CF821B-9ECC-4F6C-B0BC-7361370776C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.2","matchCriteriaId":"84278A89-0D1B-4CFD-9B31-68D8D7327E65"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.3","matchCriteriaId":"7B4FA857-692C-4C00-A170-1F31E6D9563E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.20.0","versionEndExcluding":"2.20.2","matchCriteriaId":"BD4C8899-C9E7-4DFC-BE17-D5D67B9B5FFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.21.0","versionEndExcluding":"2.21.1","matchCriteriaId":"4392299F-8DFB-4ADF-BAA8-4415D459E8EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.2","matchCriteriaId":"025C10E9-40A6-408C-AE2C-5FC55E788775"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.23.0","versionEndExcluding":"2.23.1","matchCriteriaId":"C9073ABE-276B-4301-B39C-B9BB6C1AA681"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.24.0","versionEndExcluding":"2.24.1","matchCriteriaId":"B6D58347-1CE3-4AEA-9617-2F46CCBE167E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"secure@microsoft.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"secure@microsoft.com"},{"url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","source":"secure@microsoft.com"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"secure@microsoft.com"},{"url":"https://security.gentoo.org/glsa/202003-30","source":"secure@microsoft.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-30","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2014-9390","sourceIdentifier":"cve@mitre.org","published":"2020-02-12T02:15:10.963","lastModified":"2026-06-17T00:18:16.477","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem."},{"lang":"es","value":"Git versiones anteriores a 1.8.5.6, versiones 1.9.x anteriores a 1.9.5, versiones  2.0.x anteriores a 2.0.5, versiones 2.1.x anteriores a 2.1.4 y versiones 2.2.x anteriores a 2.2.1 en Windows y OS X; Mercurial versiones anteriores a 3.2.3 en Windows y OS X; Apple Xcode versiones anteriores a 6.2 beta 3;  mine todas las versiones antes del 08-12-2014; libgit2 todas las versiones hasta 0.21. 2; Egit todas las versiones anteriores al 08-12-2014; y JGit todas las versiones anteriores al 08-12-2014 permiten a los servidores Git remotos ejecutar comandos arbitrarios por medio de un árbol que contiene un archivo .git/config diseñado con (1) un punto de código Unicode ignorable, (2) una representación git~1/config, o (3) mayúsculas y minúsculas que no son manejadas apropiadamente en un sistema de archivos insensible a mayúsculas y minúsculas"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"1.8.5.6","matchCriteriaId":"BDA7AD30-7C02-418F-A62D-9C4C179088DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"1.9.0","versionEndExcluding":"1.9.5","matchCriteriaId":"639D829A-5F78-49EB-924E-F6495EEB5153"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.5","matchCriteriaId":"9080C10B-548A-45AF-9B62-F80B92EEB4F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.0","versionEndExcluding":"2.1.4","matchCriteriaId":"853D6A11-7FA6-4A92-87E2-6F7756E1C96A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.2.1","matchCriteriaId":"BDEC04F1-09CA-4957-90B6-5D87A68C2C06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*","matchCriteriaId":"4781BF1E-8A4E-4AFF-9540-23D523EE30DD"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.3","matchCriteriaId":"99B4890E-102C-442D-AB16-4D859A595656"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*","matchCriteriaId":"4781BF1E-8A4E-4AFF-9540-23D523EE30DD"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndIncluding":"6.1.1","matchCriteriaId":"8DDD1870-453C-4B97-BE7B-9B3D6D4856D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:6.2:-:*:*:*:*:*:*","matchCriteriaId":"9D061C24-F869-456D-8D26-8B6F63B6C834"},{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:6.2:beta_2:*:*:*:*:*:*","matchCriteriaId":"0CD44704-4632-43DC-BC56-F872BCAF3E97"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:eclipse:egit:*:*:*:*:*:*:*:*","versionEndExcluding":"08-12-2014","matchCriteriaId":"EB77E9A5-6A32-42BE-81C0-7D87A2076688"},{"vulnerable":true,"criteria":"cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*","versionEndExcluding":"3.4.2","matchCriteriaId":"D5351751-FCFD-429E-8FF4-B8E9954D7248"},{"vulnerable":true,"criteria":"cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5.0","versionEndExcluding":"3.5.3","matchCriteriaId":"D1B88228-1044-4794-A954-A1CA8954D1BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*","versionEndExcluding":"0.21.3","matchCriteriaId":"973A3E4A-6E15-4137-9933-4609A9CC805C"}]}]}],"references":[{"url":"http://article.gmane.org/gmane.linux.kernel/1853266","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://mercurial.selenic.com/wiki/WhatsNew","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"http://securitytracker.com/id?1031404","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://support.apple.com/kb/HT204147","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://github.com/blog/1938-git-client-vulnerability-announced","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://libgit2.org/security/","source":"cve@mitre.org","tags":["Product"]},{"url":"https://news.ycombinator.com/item?id=8769667","source":"cve@mitre.org","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"http://article.gmane.org/gmane.linux.kernel/1853266","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://mercurial.selenic.com/wiki/WhatsNew","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"http://securitytracker.com/id?1031404","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://support.apple.com/kb/HT204147","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/blog/1938-git-client-vulnerability-announced","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://libgit2.org/security/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]},{"url":"https://news.ycombinator.com/item?id=8769667","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-5260","sourceIdentifier":"security-advisories@github.com","published":"2020-04-14T23:15:12.607","lastModified":"2026-06-17T03:21:09.197","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."},{"lang":"es","value":"Las versiones afectadas de Git presentan una vulnerabilidad por la cual Git puede ser engañado para enviar credenciales privadas a un host controlado por un atacante. Git usa programas externos de \"credential helper\" para almacenar y recuperar contraseñas u otras credenciales del almacenamiento seguro provistas por el sistema operativo. Las URL especialmente diseñadas que contienen una nueva línea codificada pueden inyectar valores no deseados en la secuencia del protocolo credential helper, causando que el asistente de credenciales recupere la contraseña de un servidor (por ejemplo, good.example.com) para una petición HTTP que se lleva a cabo en otro servidor ( por ejemplo, evil.example.com), resultando en que las credenciales para el primero se envíen al segundo. No existen restricciones en la relación entre los dos, lo que significa que un atacante puede crear una URL que presente credenciales almacenadas para cualquier host a un host de su elección. La vulnerabilidad puede ser activada alimentando una URL maliciosa a git clone. Sin embargo, las URL afectadas lucen bastante sospechosas; el vector probable sería por medio de sistemas que clonan automáticamente las URL no visibles para el usuario, como submódulos de Git o sistemas de paquetes creados alrededor de Git. El problema se ha corregido en las versiones publicadas el 14 de abril de 2020, que se remontan a las versiones v2.17.x. Cualquiera que desee respaldar el cambio aún más puede hacerlo aplicando el commit 9a6bbee (la versión completa incluye comprobaciones adicionales para git fsck, pero ese commit es suficiente para proteger a los clientes contra la vulnerabilidad). Las versiones parcheadas son: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.17.4","status":"affected"},{"version":">= 2.18.0, < 2.18.3","status":"affected"},{"version":">= 2.19.0, 2.19.4","status":"affected"},{"version":">= 2.20.0, < 2.20.3","status":"affected"},{"version":">= 2.21.0, < 2.21.2","status":"affected"},{"version":">= 2.22.0, < 2.22.3","status":"affected"},{"version":">= 2.23.0, < 2.23.2","status":"affected"},{"version":">= 2.24.0, < 2.24.2","status":"affected"},{"version":">= 2.25.0, < 2.25.3","status":"affected"},{"version":">= 2.26.0, < 2.26.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.17.4","matchCriteriaId":"6FA998D4-C2C4-44EE-901D-CF5936D7D1F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.3","matchCriteriaId":"B14A2B17-C2F7-4DB6-8CC1-B77C4FF9ACD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.3","matchCriteriaId":"E405970A-87F9-4EE3-A039-50B150ADAD85"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.4","matchCriteriaId":"40D4CABA-6F48-49AD-96A4-E036EAB3177A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.20.0","versionEndExcluding":"2.20.3","matchCriteriaId":"0655FC8A-0AB5-4148-A97F-8673C2741D81"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.21.0","versionEndExcluding":"2.21.2","matchCriteriaId":"038B2F58-867C-4D3D-9DB8-AE2481285786"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.23.0","versionEndExcluding":"2.23.2","matchCriteriaId":"51FB16E7-BC48-4333-85FF-335318B987CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.24.0","versionEndExcluding":"2.24.2","matchCriteriaId":"8AF1F1BC-33E7-4E0E-8BBB-159D91724133"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.25.0","versionEndExcluding":"2.25.3","matchCriteriaId":"DA825115-AFF5-4F6A-AB80-ABF1540744B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.26.0","versionEndExcluding":"2.26.1","matchCriteriaId":"D3219B2B-172D-4DAF-B345-6EDC0330CC8F"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*","matchCriteriaId":"A31C8344-3E02-4EB8-8BD8-4C84B7959624"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","matchCriteriaId":"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","matchCriteriaId":"80F0FA5D-8D3B-4C0E-81E2-87998286AF33"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*","matchCriteriaId":"36D96259-24BD-44E2-96D9-78CE1D41F956"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","source":"security-advisories@github.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/15/5","source":"security-advisories@github.com","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/15/6","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/20/1","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","source":"security-advisories@github.com","tags":["Mitigation","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","source":"security-advisories@github.com"},{"url":"https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202004-13","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT211141","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4329-1/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4657","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/15/5","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/15/6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/20/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202004-13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT211141","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4329-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4657","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-11008","sourceIdentifier":"security-advisories@github.com","published":"2020-04-21T19:15:13.457","lastModified":"2026-06-17T02:48:50.910","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a \"blank\" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's \"store\" helper - Git's \"cache\" helper - the \"osxkeychain\" helper that ships in Git's \"contrib\" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability."},{"lang":"es","value":"Las versiones afectadas de Git tienen una vulnerabilidad por la que Git puede ser engañado para que envíe credenciales privadas a un host controlado por un atacante. Este fallo es similar al CVE-2020-5260 (GHSA-qm7j-c969-7j4q). La corrección de ese bug todavía deja la puerta abierta para una explotación donde se filtra la credencial de _some_ (pero el atacante no puede controlar cuál). Git utiliza programas externos de \"credential helper\" para almacenar y recuperar contraseñas u otras credenciales desde el almacenamiento seguro proporcionado por el sistema operativo. Las URLs especialmente diseñadas que se consideran ilegales a partir de las versiones de Git recientemente publicadas pueden hacer que Git envíe un patrón \"blank\" a los asistentes, faltando los campos hostname y protocol. Muchos asistentes interpretarán esto como una coincidencia con la URL _any_, y devolverán alguna contraseña almacenada sin especificar, filtrando la contraseña hacia el servidor de un atacante. La vulnerabilidad puede ser desencadenada alimentando una URL maliciosa a \"git clone\". Sin embargo, las URLs afectadas parecen bastante sospechosas; el vector probable sería por medio de sistemas que clonan automáticamente las URLs no visibles para el usuario, tales como los submódulos de Git, o sistemas de paquetes construidos alrededor de Git. La raíz del problema está en el propio Git, que no debería estar alimentando con entradas en blanco a los asistentes. Sin embargo, la capacidad de explotar la vulnerabilidad en la práctica depende de los asistentes que se utilicen. Los asistentes con credenciales que se sabe que desencadenan la vulnerabilidad: - El asistente \"store\" de Git - El asistente \"cache\" de Git - El asistente \"osxkeychain\" que se incluye en los asistentes de Credenciales del directorio \"contrib\" de Git que se conoce que son seguros incluso con versiones vulnerables de Git: - Cualquier asistente de Git Credential Manager para Windows que no esté en esta lista, se debe asumir que desencadena la vulnerabilidad."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.17.5","status":"affected"},{"version":">= 2.18.0, < 2.18.4","status":"affected"},{"version":">= 2.19.0, 2.19.5","status":"affected"},{"version":">= 2.20.0, < 2.20.4","status":"affected"},{"version":">= 2.21.0, < 2.21.3","status":"affected"},{"version":">= 2.22.0, < 2.22.4","status":"affected"},{"version":">= 2.23.0, < 2.23.3","status":"affected"},{"version":">= 2.24.0, < 2.24.3","status":"affected"},{"version":">= 2.25.0, < 2.25.4","status":"affected"},{"version":">= 2.26.0, < 2.26.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.17.5","matchCriteriaId":"A186DC51-DE8D-4CDB-BEAD-475935A09B26"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.4","matchCriteriaId":"58AE7EAD-B185-4A6A-B0E9-9D8524C60072"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.5","matchCriteriaId":"C84AEEBC-8FBB-467E-B27F-AE89A976A2B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.20.0","versionEndExcluding":"2.20.4","matchCriteriaId":"E576EE5A-19AE-4DA8-B68D-E7FEC317A737"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.21.0","versionEndExcluding":"2.21.3","matchCriteriaId":"A3C2AA1C-4CDC-4DF7-9BFC-07313AF87903"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.4","matchCriteriaId":"75C66031-DF10-41CE-8A96-60BEFDE87B38"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.23.0","versionEndExcluding":"2.23.3","matchCriteriaId":"34A96F37-0E8A-4C56-BF7A-0987E18F7BFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.24.0","versionEndExcluding":"2.24.3","matchCriteriaId":"5FCA2D68-889E-4358-AF00-D94D7117DB5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.25.0","versionEndExcluding":"2.25.4","matchCriteriaId":"76FA3125-7826-4480-A06E-B81940FD22E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.26.0","versionEndExcluding":"2.26.2","matchCriteriaId":"8318D40D-AD16-461E-9D25-AC0069864832"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*","matchCriteriaId":"A31C8344-3E02-4EB8-8BD8-4C84B7959624"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","matchCriteriaId":"80F0FA5D-8D3B-4C0E-81E2-87998286AF33"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*","matchCriteriaId":"36D96259-24BD-44E2-96D9-78CE1D41F956"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"security-advisories@github.com"},{"url":"http://seclists.org/fulldisclosure/2020/May/41","source":"security-advisories@github.com"},{"url":"https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","source":"security-advisories@github.com","tags":["Mitigation","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202004-13","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT211183","source":"security-advisories@github.com"},{"url":"https://usn.ubuntu.com/4334-1/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2020/May/41","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202004-13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT211183","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4334-1/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-21300","sourceIdentifier":"security-advisories@github.com","published":"2021-03-09T20:15:13.260","lastModified":"2026-06-17T03:35:14.770","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6."},{"lang":"es","value":"Git es un sistema de control de revisiones distribuido de código abierto.&#xa0;En las versiones afectadas de Git, un repositorio especialmente diseñado que contiene enlaces simbólicos, así como archivos que usan un filtro clean/smudge como Git LFS, puede hacer que se ejecute un script recién extraído mientras se clona en un sistema de archivos que no distingue entre mayúsculas y minúsculas como NTFS , HFS+ o APFS (es decir, los sistemas de archivos predeterminados en Windows y macOS).&#xa0;Tome en cuenta que los filtros de clean/smudge deben ser configurados para eso.&#xa0;Git para Windows configura Git LFS por defecto y, por lo tanto, es vulnerable.&#xa0;El problema se ha corregido en las versiones publicadas el martes 9 de marzo de 2021. Como solución temporal, si el soporte de enlace simbólico está deshabilitado en Git (por ejemplo, por medio de \"git config --global core.symlinks false\"), el ataque descrito no funcionará.&#xa0;Del mismo modo, si no se configuran globalmente filtros clean/smudge como Git LFS (es decir,_before_ cloning), el ataque se frustra.&#xa0;Como siempre, es mejor evitar la clonación de repositorios de fuentes no confiables.&#xa0;La primera versión afectada es 2.14.2.&#xa0;Las versiones correctas son: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19 .6, 2.18.5, 2.17.62.17.6"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":">= 2.14.2, < 2.17.62.17.6","status":"affected"},{"version":">= 2.18.0, < 2.18.5","status":"affected"},{"version":">= 2.19.0, < 2.19.6","status":"affected"},{"version":">= 2.20.0, < 2.20.5","status":"affected"},{"version":">= 2.21.0, < 2.21.4","status":"affected"},{"version":">= 2.22.0, < 2.22.5","status":"affected"},{"version":">= 2.23.0, < 2.23.4","status":"affected"},{"version":">= 2.24.0, < 2.24.4","status":"affected"},{"version":">= 2.25.0, < 2.25.5","status":"affected"},{"version":">= 2.26.0, < 2.26.3","status":"affected"},{"version":">= 2.27.0, < 2.27.1","status":"affected"},{"version":">= 2.28.0, < 2.28.1","status":"affected"},{"version":">= 2.29.0, < 2.29.3","status":"affected"},{"version":">= 2.30.0, < 2.30.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P","baseScore":5.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":4.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.14.2","matchCriteriaId":"B122112C-041C-4E35-A95B-09A6FEB34E66"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.17.0","versionEndExcluding":"2.17.6","matchCriteriaId":"F22EC766-C4F5-478C-812C-DC0ECE2B5017"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.18.0","versionEndExcluding":"2.18.5","matchCriteriaId":"852AD237-C1C7-4C6D-8CD0-46FC6CF3CA2A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.19.0","versionEndExcluding":"2.19.6","matchCriteriaId":"3964581A-A764-44AC-96AA-0FBAC723876C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.20.0","versionEndExcluding":"2.20.5","matchCriteriaId":"6B873D83-F63E-4183-8DF5-FB2CA9F7442A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.21.0","versionEndExcluding":"2.21.4","matchCriteriaId":"28F16A48-7467-428E-A797-F17C1B33D845"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.22.0","versionEndExcluding":"2.22.5","matchCriteriaId":"344A8A7D-A440-46D2-A424-FE9576211B66"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.23.0","versionEndExcluding":"2.23.4","matchCriteriaId":"E08D59A6-5026-4E64-A685-3F3C61384AA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.24.0","versionEndExcluding":"2.24.4","matchCriteriaId":"800D0A90-9ABA-49AE-AC15-FAB0EAD8E6B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.25.0","versionEndExcluding":"2.25.5","matchCriteriaId":"F73CA1C3-0970-4A25-86DF-D6BCF6A245D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.26.0","versionEndExcluding":"2.26.3","matchCriteriaId":"C55EAADC-86F7-48AD-ADE6-EAC35900ACCE"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.29.0","versionEndExcluding":"2.29.3","matchCriteriaId":"60B8D72E-7390-4748-85C3-2143B473B8A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.30.0","versionEndExcluding":"2.30.2","matchCriteriaId":"3B4C27E1-AB72-4ABB-8BEF-BA317C229CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.27.0:*:*:*:*:*:*:*","matchCriteriaId":"1A303CF1-7129-4C24-B6EB-03E7F5A51FB7"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.28.0:*:*:*:*:*:*:*","matchCriteriaId":"8920211C-E92D-41FD-BBFA-4702FB07B4D4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*","matchCriteriaId":"36D96259-24BD-44E2-96D9-78CE1D41F956"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","matchCriteriaId":"E460AA51-FCDA-46B9-AE97-E6676AA5E194"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"12.5","matchCriteriaId":"BD2A6382-E564-4CF6-AE51-62A021766671"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0","matchCriteriaId":"FD77D019-6FF7-4D3B-BE07-65C7A6879F12"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2021/Apr/60","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/09/3","source":"security-advisories@github.com","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://git-scm.com/docs/gitattributes#_filter","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/","source":"security-advisories@github.com"},{"url":"https://lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202104-01","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT212320","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2021/Apr/60","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/09/3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://git-scm.com/docs/gitattributes#_filter","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202104-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT212320","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-40330","sourceIdentifier":"cve@mitre.org","published":"2021-08-31T04:15:10.667","lastModified":"2026-06-17T04:06:44.270","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring."},{"lang":"es","value":"La función git_connect_git en el archivo connect.c en Git versiones anteriores a 2.30.1, permite que la ruta de un repositorio contenga un carácter de nueva línea, que puede resultar en peticiones inesperadas entre protocolos, como es demostrado en la subcadena git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.1","matchCriteriaId":"12210C13-4B94-4F02-B7F3-ACE1ECD2F54B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473","source":"cve@mitre.org","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/compare/v2.30.0...v2.30.1","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/compare/v2.30.0...v2.30.1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-24975","sourceIdentifier":"cve@mitre.org","published":"2022-02-11T20:15:07.507","lastModified":"2026-06-17T04:32:53.100","vulnStatus":"Modified","cveTags":[{"sourceIdentifier":"cve@mitre.org","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the \"GitBleed\" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk."},{"lang":"es","value":"La documentación --mirror para Git versiones hasta 2.35.1, no menciona la disponibilidad del contenido eliminado, también se conoce como el problema \"GitBleed\". Esto podría presentar un riesgo de seguridad si los procesos de auditoría de divulgación de información dependen de una operación de clonación sin la opción --mirror"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-668"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.35.1","matchCriteriaId":"0342C612-A603-40D9-B6EF-B8D8D3DAA3A5"}]}]}],"references":[{"url":"https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191","source":"cve@mitre.org","tags":["Exploit","Vendor Advisory"]},{"url":"https://lore.kernel.org/git/xmqq4k14qe9g.fsf%40gitster.g/","source":"cve@mitre.org"},{"url":"https://www.aquasec.com/blog/undetected-hard-code-secrets-expose-corporations/","source":"cve@mitre.org"},{"url":"https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.aquasec.com/blog/undetected-hard-code-secrets-expose-corporations/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-24765","sourceIdentifier":"security-advisories@github.com","published":"2022-04-12T18:15:09.390","lastModified":"2026-06-17T04:32:28.087","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\\.git\\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\\Users` if the user profile is located in `C:\\Users\\my-user-name`."},{"lang":"es","value":"Git para Windows es un fork de Git que contiene parches específicos para Windows. Esta vulnerabilidad afecta a usuarios que trabajan en máquinas multiusuario, donde partes no confiables presentan acceso de escritura al mismo disco duro. Estas partes no confiables podrían crear la carpeta \"C:\\.git\", que sería recogida por las operaciones de Git ejecutadas supuestamente fuera de un repositorio mientras es buscado un directorio Git. Git respetaría entonces cualquier configuración en dicho directorio Git. Los usuarios de Git Bash que configuren \"GIT_PS1_SHOWDIRTYSTATE\" también son vulnerables. Los usuarios que hayan instalado posh-git son vulnerables simplemente al iniciar un PowerShell. Los usuarios de IDEs como Visual Studio son vulnerables: la simple creación de un nuevo proyecto ya leería y respetaría la configuración especificada en \"C:\\.git\\config\". Los usuarios del fork de Microsoft de Git son vulnerables simplemente al iniciar un Git Bash. El problema ha sido parcheado en Git para Windows versión v2.35.2. Los usuarios que no puedan actualizarse pueden crear la carpeta \".git\" en todas las unidades en las que sean ejecutados comandos de Git, y eliminar el acceso de lectura/escritura de esas carpetas como medida de mitigación. Como alternativa, defina o amplíe \"GIT_CEILING_DIRECTORIES\" para que cubra el directorio _parent_ del perfil de usuario, por ejemplo, \"C:\\Users\" si el perfil de usuario es encontrado en \"C:\\Users\\my-user-name\""}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git-for-windows","product":"git","versions":[{"version":"< 2.35.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-16T17:47:32.484278Z","id":"CVE-2022-24765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.35.2","matchCriteriaId":"F3ACE235-32E1-429A-9A82-628C9D25CADE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","matchCriteriaId":"E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"13.4","matchCriteriaId":"ABC5ECCF-B646-4686-AE1E-6F1122B108BB"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"http://seclists.org/fulldisclosure/2022/May/31","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/12/7","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://support.apple.com/kb/HT213261","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/May/31","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/12/7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213261","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-29187","sourceIdentifier":"security-advisories@github.com","published":"2022-07-12T21:15:09.560","lastModified":"2026-06-17T04:39:46.357","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks."},{"lang":"es","value":"Git es un sistema de control de revisión distribuido. Git versiones anteriores a 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4 y 2.30.5, es vulnerable a la escalada de privilegios en todas las plataformas. Un usuario desprevenido aún podría verse afectado por el problema reportado en CVE-2022-24765, por ejemplo cuando navega como root en un directorio tmp compartido que es de su propiedad, pero donde un atacante podría crear un repositorio git. Las versiones 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4 y 2.30.5 contienen un parche para este problema. La forma más sencilla de evitar ser afectado por la explotación descrita en el ejemplo es evitar ejecutar git como root (o como administrador en Windows), y si es necesario reducir su uso al mínimo. Aunque no es posible una mitigación genérica, un sistema puede ser reforzado contra la explotación descrito en el ejemplo eliminando cualquier repositorio de este tipo si ya se presenta y creando uno como root para bloquear cualquier ataque futuro"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":">= 2.30.3, < 2.30.5","status":"affected"},{"version":">= 2.31.2, < 2.31.4","status":"affected"},{"version":">= 2.32.1, < 2.32.3","status":"affected"},{"version":">= 2.33.2, < 2.33.4","status":"affected"},{"version":">= 2.34.2, < 2.34.4","status":"affected"},{"version":">= 2.35.2, < 2.35.4","status":"affected"},{"version":">= 2.36, < 2.36.2","status":"affected"},{"version":">= 2.37, < 2.37.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-282"},{"lang":"en","value":"CWE-427"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.30.3","versionEndExcluding":"2.30.5","matchCriteriaId":"CF6F4F50-E470-445C-997D-AF8F00EA5DB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.2","versionEndExcluding":"2.31.4","matchCriteriaId":"BD094817-F700-4F5C-9595-D763B959E9E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.1","versionEndExcluding":"2.32.3","matchCriteriaId":"823D7473-2511-4C8E-AE94-C0341EC87507"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.2","versionEndExcluding":"2.33.4","matchCriteriaId":"2E1918C0-8038-433B-ABBE-842F1B280061"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.2","versionEndExcluding":"2.34.4","matchCriteriaId":"5F98C9BC-FA28-4ED6-8DAD-7FAE6EB00D83"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.2","versionEndExcluding":"2.35.4","matchCriteriaId":"F1AC0DD7-AB8F-4643-A392-282AE4AC04D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.2","matchCriteriaId":"D8C0EEA2-49DE-4D7A-807C-7872A471499E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.1","matchCriteriaId":"175F385C-C0A1-490C-812C-F4F73F6D4A40"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","matchCriteriaId":"E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"14.1","matchCriteriaId":"CECD39AA-41F4-4638-B59A-C5E928B585C3"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"http://seclists.org/fulldisclosure/2022/Nov/1","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/07/14/1","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.blog/2022-04-12-git-security-vulnerability-announced","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-j342-m5hw-rr3v","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/","source":"security-advisories@github.com"},{"url":"https://lore.kernel.org/git/xmqqv8s2fefi.fsf%40gitster.g/T/#u","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202401-17","source":"security-advisories@github.com"},{"url":"https://support.apple.com/kb/HT213496","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Nov/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/07/14/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.blog/2022-04-12-git-security-vulnerability-announced","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-j342-m5hw-rr3v","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lore.kernel.org/git/xmqqv8s2fefi.fsf%40gitster.g/T/#u","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202401-17","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213496","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-39253","sourceIdentifier":"security-advisories@github.com","published":"2022-10-19T11:15:11.227","lastModified":"2026-06-17T04:58:00.250","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`."},{"lang":"es","value":"Git es un sistema de control de revisiones distribuido, escalable y de código abierto. Las versiones anteriores a la 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 están sujetas a una exposición de información confidencial a un actor malicioso. Cuando es llevado a cabo un clon local (en el que el origen y el destino del clon están en el mismo volumen), Git copia el contenido del directorio \"$GIT_DIR/objects\" del origen en el destino creando enlaces duros al contenido del origen o copiándolo (si los enlaces duros están deshabilitados por medio de \"--no-hardlinks\"). Un actor malicioso podría convencer a una víctima de clonar un repositorio con un enlace simbólico que apunte a información confidencial en la máquina de la víctima. Esto puede hacerse ya sea que la víctima clone un repositorio malicioso en la misma máquina, o haciendo que clone un repositorio malicioso insertado como repositorio desnudo por medio de un submódulo de cualquier fuente, siempre que clone con la opción \"--recurse-submodules\". Git no crea enlaces simbólicos en el directorio \"$GIT_DIR/objects\". El problema ha sido parcheado en las versiones publicadas el 18-10-2022, y retrocedido a v2.30.x. Posibles mitigaciones: Evite clonar repositorios no confiables usando la optimización \"--local\" cuando esté en una máquina compartida, ya sea pasando la opción \"--no-local\" a \"git clone\" o clonando desde una URL que use el esquema \"file://\". Alternativamente, evita clonar repositorios de fuentes no confiables con \"--recurse-submodules\" o ejecuta \"git config --global protocol.file.allow user\""}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.30.6","status":"affected"},{"version":"< 2.31.5","status":"affected"},{"version":"< 2.32.4","status":"affected"},{"version":"< 2.33.5","status":"affected"},{"version":"< 2.34.5","status":"affected"},{"version":"< 2.35.5","status":"affected"},{"version":"< 2.36.3","status":"affected"},{"version":"< 2.37.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.6","matchCriteriaId":"28199E8F-36D0-46F8-AF0A-9460390BE56F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndExcluding":"2.31.5","matchCriteriaId":"E095AAE7-18C2-4957-9740-FC804860B9C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndExcluding":"2.32.4","matchCriteriaId":"459EE43E-40FB-45BE-A1CC-51435E9F92AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndExcluding":"2.33.5","matchCriteriaId":"2CBDDA42-F5EC-4747-BF3C-16683D684702"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndExcluding":"2.34.5","matchCriteriaId":"D7691E22-145E-4D97-A6E0-6515742781B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.5","matchCriteriaId":"E02396C2-BB34-4D18-917E-DA56EA7B58B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.3","matchCriteriaId":"51BEAEEC-9D9D-4CFE-8958-43BFE87DE501"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.4","matchCriteriaId":"566CF89C-AC39-47D7-B3DE-633B2237F816"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*","matchCriteriaId":"1AFEECCB-B8DB-4270-A860-C2BA1C7B267C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","matchCriteriaId":"E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"14.1","matchCriteriaId":"CECD39AA-41F4-4638-B59A-C5E928B585C3"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"http://seclists.org/fulldisclosure/2022/Nov/1","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/14/5","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"security-advisories@github.com"},{"url":"https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://support.apple.com/kb/HT213496","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Nov/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/14/5","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213496","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-39260","sourceIdentifier":"security-advisories@github.com","published":"2022-10-19T12:15:10.160","lastModified":"2026-06-17T04:58:01.303","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround."},{"lang":"es","value":"Git es un sistema de control de revisiones distribuido, escalable y de código abierto. \"git shell\" es un shell de acceso restringido que puede ser usado para implementar la funcionalidad push/pull de Git por medio de SSH. En versiones anteriores a 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4, la función que divide los argumentos del comando en un array usa incorrectamente un \"int\" para representar el número de entradas en el array, permitiendo a un actor malicioso desbordar intencionadamente el valor de retorno, conllevando a escrituras arbitrarias en la pila. Dado que la matriz resultante es pasada a \"execv()\", es posible aprovechar este ataque para obtener la ejecución de código remota en una máquina víctima. Tenga en cuenta que una víctima debe permitir primero el acceso a \"git shell\" como shell de inicio de sesión para ser vulnerable a este ataque. Este problema está parcheado en versiones 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3 y 2.37.4 y es recomendado a usuarios actualizar a la última versión. Deshabilitar el acceso al \"git shell\" por medio de inicios de sesión remotos es una mitigación viable a corto plazo"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.30.6","status":"affected"},{"version":"> 2.31.0, < 2.31.5","status":"affected"},{"version":"> 2.32.0, < 2.32.4","status":"affected"},{"version":"> 2.33.0, < 2.33.5","status":"affected"},{"version":"> 2.34.0, < 2.34.5","status":"affected"},{"version":"> 2.34.0, < 2.35.5","status":"affected"},{"version":"> 2.35.0, < 2.36.3","status":"affected"},{"version":"> 2.37.0, < 2.37.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-787"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.6","matchCriteriaId":"28199E8F-36D0-46F8-AF0A-9460390BE56F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndExcluding":"2.31.5","matchCriteriaId":"E095AAE7-18C2-4957-9740-FC804860B9C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndExcluding":"2.32.4","matchCriteriaId":"459EE43E-40FB-45BE-A1CC-51435E9F92AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndExcluding":"2.33.5","matchCriteriaId":"2CBDDA42-F5EC-4747-BF3C-16683D684702"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndExcluding":"2.34.5","matchCriteriaId":"D7691E22-145E-4D97-A6E0-6515742781B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.5","matchCriteriaId":"E02396C2-BB34-4D18-917E-DA56EA7B58B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.3","matchCriteriaId":"51BEAEEC-9D9D-4CFE-8958-43BFE87DE501"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.4","matchCriteriaId":"566CF89C-AC39-47D7-B3DE-633B2237F816"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.38.0:*:*:*:*:*:*:*","matchCriteriaId":"1AFEECCB-B8DB-4270-A860-C2BA1C7B267C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","matchCriteriaId":"E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"14.1","matchCriteriaId":"CECD39AA-41F4-4638-B59A-C5E928B585C3"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"http://seclists.org/fulldisclosure/2022/Nov/1","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/","source":"security-advisories@github.com"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://support.apple.com/kb/HT213496","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Nov/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213496","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-41953","sourceIdentifier":"security-advisories@github.com","published":"2023-01-17T22:15:10.747","lastModified":"2026-06-17T05:04:07.690","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources."},{"lang":"es","value":"Git GUI es una práctica herramienta gráfica que viene con Git para Windows. Su público objetivo son los usuarios que no se sienten cómodos usando Git en la línea de comandos. Git GUI tiene una función para clonar repositorios. Inmediatamente después de que el clon local esté disponible, la GUI de Git lo procesará automáticamente y, entre otras cosas, ejecutará un corrector ortográfico llamado `aspell.exe` si se encuentra. La GUI de Git se implementa como un script Tcl/Tk. Debido al desafortunado diseño de Tcl en Windows, la ruta de búsqueda cuando se busca un ejecutable _siempre incluye el directorio actual_. Por lo tanto, los repositorios maliciosos pueden incluir un `aspell.exe` en su directorio de nivel superior que se ejecuta mediante la GUI de Git sin darle al usuario la oportunidad de inspeccionarlo primero, es decir, ejecutando código que no es de confianza. Este problema se solucionó en la versión 2.39.1. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben evitar usar la GUI de Git para la clonación. Si esa no es una opción viable, al menos evite la clonación de fuentes no confiables."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git-for-windows","product":"git","versions":[{"version":"< 2.39.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-10T20:58:35.869270Z","id":"CVE-2022-41953","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-426"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.39.1","matchCriteriaId":"A20392B8-194B-4CF5-AC5F-BADD4BA6F8BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://github.com/git-for-windows/git/commit/7360767e8dfc1895a932324079f7d45d7791d39f","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git-for-windows/git/pull/4219","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99c","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.tcl.tk/man/tcl8.6/TclCmd/exec.html#M23","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/git-for-windows/git/commit/7360767e8dfc1895a932324079f7d45d7791d39f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git-for-windows/git/pull/4219","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99c","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.tcl.tk/man/tcl8.6/TclCmd/exec.html#M23","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-23521","sourceIdentifier":"security-advisories@github.com","published":"2023-01-17T23:15:15.580","lastModified":"2026-06-17T04:30:17.417","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue."},{"lang":"es","value":"Git es un sistema de control de revisiones distribuido. Los gitattributes son un mecanismo que permite definir atributos para las rutas. Estos atributos se pueden definir agregando un archivo `.gitattributes` al repositorio, que contiene un conjunto de patrones de archivos y los atributos que deben establecerse para las rutas que coincidan con este patrón. Al analizar gitattributes, pueden ocurrir múltiples desbordamientos de enteros cuando hay una gran cantidad de patrones de ruta, una gran cantidad de atributos para un solo patrón o cuando los nombres de atributos declarados son enormes. Estos desbordamientos se pueden desencadenar a través de un archivo `.gitattributes` manipulado que puede ser parte del historial de confirmaciones. Git divide silenciosamente líneas de más de 2 KB cuando analiza los atributos de git de un archivo, pero no cuando los analiza desde el índice. En consecuencia, el modo de falla depende de si el archivo existe en el árbol de trabajo, en el índice o en ambos. Este desbordamiento de enteros puede provocar lecturas y escrituras arbitrarias en el almacenamiento dinámico, lo que puede provocar la ejecución remota de código. El problema ha sido solucionado en las versiones publicadas el 17-01-2023, remontándose a la v2.30.7. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.30.7","status":"affected"},{"version":">= 2.31.0, < 2.31.6","status":"affected"},{"version":">= 2.32.0, < 2.32.5","status":"affected"},{"version":">= 2.33.0, < 2.33.6","status":"affected"},{"version":">= 2.34.0, < 2.34.6","status":"affected"},{"version":">= 2.35.0, < 2.35.6","status":"affected"},{"version":">= 2.36.0, < 2.36.4","status":"affected"},{"version":">= 2.37.0, < 2.37.5","status":"affected"},{"version":">= 2.38.0, < 2.38.3","status":"affected"},{"version":"= 2.39.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-15T17:36:25.330950Z","id":"CVE-2022-23521","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.30.6","matchCriteriaId":"8D0B133C-FC2B-4CBF-8840-C85F6D650510"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndIncluding":"2.31.5","matchCriteriaId":"BA5113C4-D095-4E76-A6C6-F849E11DFA9D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndIncluding":"2.32.4","matchCriteriaId":"B82E8E87-1083-45B9-A273-E6AB31548D56"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndIncluding":"2.33.5","matchCriteriaId":"C9162726-CACE-4CB9-ACDE-204655D6BB3B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndIncluding":"2.34.5","matchCriteriaId":"65D149AF-5604-4109-A60B-CB7B5BBBEE87"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndIncluding":"2.35.5","matchCriteriaId":"383C057B-98D3-4AC6-9D43-AE13CC81FEC4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndIncluding":"2.36.3","matchCriteriaId":"7B191BB2-D3C9-440D-8F7F-237BE0CBDB96"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndIncluding":"2.37.4","matchCriteriaId":"E3F7AE8C-A383-442C-8E74-7BC13E8B251D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.38.0","versionEndIncluding":"2.38.2","matchCriteriaId":"28F8851A-1566-4F16-AEC4-2C09AC866C2A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*","matchCriteriaId":"CC98AC76-7F3E-45A0-9DE6-3D097CEE5199"}]}]}],"references":[{"url":"https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2022-41903","sourceIdentifier":"security-advisories@github.com","published":"2023-01-17T23:15:15.690","lastModified":"2026-06-17T05:04:01.900","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."},{"lang":"es","value":"Git es un sistema de control de revisiones distribuido. `git log` puede mostrar confirmaciones en un formato arbitrario usando sus especificadores `--format`. Esta funcionalidad también está expuesta a \"git archive\" a través del atributo git \"export-subst\". Al procesar los operadores de relleno, hay un desbordamiento de enteros en `pretty.c::format_and_pad_commit()` donde `size_t` se almacena incorrectamente como `int` y luego se agrega como un desplazamiento a `memcpy()`. Este desbordamiento puede ser desencadenado directamente por un usuario que ejecuta un comando que invoca la maquinaria de formato de commit (por ejemplo, `git log --format=...`). También se puede activar indirectamente a través del archivo git mediante el mecanismo export-subst, que expande los especificadores de formato dentro de los archivos dentro del repositorio durante un archivo git. Este desbordamiento de enteros puede dar lugar a escrituras arbitrarias en el almacenamiento dinámico, lo que puede dar lugar a la ejecución de código arbitrario. El problema ha sido solucionado en las versiones publicadas el 17-01-2023, remontándose a la v2.30.7. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben desactivar \"git archive\" en repositorios que no sean de confianza. Si expone el archivo git a través de `git daemon`, desactívelo ejecutando `git config --global daemon.uploadArch false`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.30.7","status":"affected"},{"version":">= 2.31.0, < 2.31.6","status":"affected"},{"version":">= 2.32.0, < 2.32.5","status":"affected"},{"version":">= 2.33.0, < 2.33.6","status":"affected"},{"version":">= 2.34.0, < 2.34.6","status":"affected"},{"version":">= 2.35.0, < 2.35.6","status":"affected"},{"version":">= 2.36.0, < 2.36.4","status":"affected"},{"version":">= 2.37.0, < 2.37.5","status":"affected"},{"version":">= 2.38.0, < 2.38.3","status":"affected"},{"version":"= 2.39.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-10T20:59:12.527761Z","id":"CVE-2022-41903","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndIncluding":"2.30.6","matchCriteriaId":"8D0B133C-FC2B-4CBF-8840-C85F6D650510"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndIncluding":"2.31.5","matchCriteriaId":"BA5113C4-D095-4E76-A6C6-F849E11DFA9D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndIncluding":"2.32.4","matchCriteriaId":"B82E8E87-1083-45B9-A273-E6AB31548D56"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndIncluding":"2.33.5","matchCriteriaId":"C9162726-CACE-4CB9-ACDE-204655D6BB3B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndIncluding":"2.34.5","matchCriteriaId":"65D149AF-5604-4109-A60B-CB7B5BBBEE87"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndIncluding":"2.35.5","matchCriteriaId":"383C057B-98D3-4AC6-9D43-AE13CC81FEC4"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndIncluding":"2.36.3","matchCriteriaId":"7B191BB2-D3C9-440D-8F7F-237BE0CBDB96"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndIncluding":"2.37.4","matchCriteriaId":"E3F7AE8C-A383-442C-8E74-7BC13E8B251D"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.38.0","versionEndIncluding":"2.38.2","matchCriteriaId":"28F8851A-1566-4F16-AEC4-2C09AC866C2A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.39.0:*:*:*:*:*:*:*","matchCriteriaId":"CC98AC76-7F3E-45A0-9DE6-3D097CEE5199"}]}]}],"references":[{"url":"https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","source":"security-advisories@github.com","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-22490","sourceIdentifier":"security-advisories@github.com","published":"2023-02-14T20:15:16.683","lastModified":"2026-10-08T22:17:22.817","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.\n\nA fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":">= 2.39.0, < 2.39.2","status":"affected"},{"version":">= 2.38.0, < 2.38.4","status":"affected"},{"version":">= 2.37.0, < 2.37.6","status":"affected"},{"version":">= 2.36.0, < 2.36.5","status":"affected"},{"version":">= 2.35.0, < 2.35.7","status":"affected"},{"version":">= 2.34.0, < 2.34.7","status":"affected"},{"version":">= 2.33.0, < 2.33.7","status":"affected"},{"version":">= 2.32.0, < 2.32.6","status":"affected"},{"version":">= 2.31.0, < 2.31.7","status":"affected"},{"version":"< 2.30.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T21:12:31.095732Z","id":"CVE-2023-22490","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.8","matchCriteriaId":"A79D6A15-AE40-4F6C-AA1F-87C902373343"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndExcluding":"2.31.7","matchCriteriaId":"D60B37A3-4B8C-4BC2-95E9-5E63EDAEBA3A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndExcluding":"2.32.6","matchCriteriaId":"E699ED14-3B80-4C04-AAA0-549F48581D66"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndExcluding":"2.33.7","matchCriteriaId":"804BE43B-E2AF-4EC8-BF8B-C292EBC4D265"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndExcluding":"2.34.7","matchCriteriaId":"098C9D07-94CD-4C87-9268-20ED94BBBE12"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.7","matchCriteriaId":"1870DF30-7795-4594-8523-DC587B60FB74"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.5","matchCriteriaId":"0588D372-41D2-442E-976E-6B24DB1A1EC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.6","matchCriteriaId":"DDF24A4B-BC6D-499D-A0B2-2F90C691F963"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.38.0","versionEndExcluding":"2.38.4","matchCriteriaId":"E7E6A7FF-F1E2-4099-9102-65F68AA42E1B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.39.0","versionEndExcluding":"2.39.2","matchCriteriaId":"52B03913-E564-4AE0-9F2E-BEAEEA13C85A"}]}]}],"references":[{"url":"https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-23946","sourceIdentifier":"security-advisories@github.com","published":"2023-02-14T20:15:17.457","lastModified":"2026-10-08T22:17:23.000","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":">= 2.39.0, < 2.39.2","status":"affected"},{"version":">= 2.38.0, < 2.38.4","status":"affected"},{"version":">= 2.37.0, < 2.37.6","status":"affected"},{"version":">= 2.36.0, < 2.36.5","status":"affected"},{"version":">= 2.35.0, < 2.35.7","status":"affected"},{"version":">= 2.34.0, < 2.34.7","status":"affected"},{"version":">= 2.33.0, < 2.33.7","status":"affected"},{"version":">= 2.32.0, < 2.32.6","status":"affected"},{"version":">= 2.31.0, < 2.31.7","status":"affected"},{"version":"< 2.30.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T21:13:34.517515Z","id":"CVE-2023-23946","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.8","matchCriteriaId":"A79D6A15-AE40-4F6C-AA1F-87C902373343"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndExcluding":"2.31.7","matchCriteriaId":"D60B37A3-4B8C-4BC2-95E9-5E63EDAEBA3A"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndExcluding":"2.32.6","matchCriteriaId":"E699ED14-3B80-4C04-AAA0-549F48581D66"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndExcluding":"2.33.7","matchCriteriaId":"804BE43B-E2AF-4EC8-BF8B-C292EBC4D265"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndExcluding":"2.34.7","matchCriteriaId":"098C9D07-94CD-4C87-9268-20ED94BBBE12"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.7","matchCriteriaId":"1870DF30-7795-4594-8523-DC587B60FB74"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.5","matchCriteriaId":"0588D372-41D2-442E-976E-6B24DB1A1EC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.6","matchCriteriaId":"DDF24A4B-BC6D-499D-A0B2-2F90C691F963"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.38.0","versionEndExcluding":"2.38.4","matchCriteriaId":"E7E6A7FF-F1E2-4099-9102-65F68AA42E1B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.39.0","versionEndExcluding":"2.39.2","matchCriteriaId":"52B03913-E564-4AE0-9F2E-BEAEEA13C85A"}]}]}],"references":[{"url":"https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-25652","sourceIdentifier":"security-advisories@github.com","published":"2023-04-25T20:15:09.933","lastModified":"2026-06-17T05:41:39.893","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists."},{"lang":"es","value":"Git es un sistema de control de revisiones. Antes de las versiones 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3 y 2.40.1, mediante alimentación entrada especialmente manipulada para `git apply --reject`, una ruta fuera del árbol de trabajo se puede sobrescribir con contenidos parcialmente controlados (correspondientes a los fragmentos rechazados del parche dado). Hay una solución disponible en las versiones 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3 y 2.40.1. Como workaround, evite usar `git apply` con `--reject` cuando aplique parches de una fuente que no sea de confianza. Utilice `git apply --stat` para inspeccionar un parche antes de aplicarlo; evite aplicar uno que cree un conflicto donde exista un enlace correspondiente al archivo `*.rej`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.30.9","status":"affected"},{"version":">= 2.31.0, < 2.31.8","status":"affected"},{"version":">= 2.32.0, < 2.32.7","status":"affected"},{"version":">= 2.33.0, < 2.33.8","status":"affected"},{"version":">= 2.34.0, < 2.34.8","status":"affected"},{"version":">= 2.35.0, < 2.35.8","status":"affected"},{"version":">= 2.36.0, < 2.36.6","status":"affected"},{"version":">= 2.37.0, < 2.37.7","status":"affected"},{"version":">= 2.38.0, < 2.38.5","status":"affected"},{"version":">= 2.39.0, < 2.39.3","status":"affected"},{"version":">= 2.40.0, < 2.40.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-01-05T19:56:20.962435Z","id":"CVE-2023-25652","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.9","matchCriteriaId":"A2E4BF99-17B8-4424-B97E-DDB8A4793DAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndExcluding":"2.31.8","matchCriteriaId":"2A1D7F29-E06F-4277-8713-1C19DE714300"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndExcluding":"2.32.7","matchCriteriaId":"0B69F022-B29E-4D9A-B4FC-78430AFF0C9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndExcluding":"2.33.8","matchCriteriaId":"8A2B603F-B8E2-4123-80A4-64E983FF1F86"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndExcluding":"2.34.8","matchCriteriaId":"26D3ED4E-246E-4D4D-9E2D-7890E93ECED8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.8","matchCriteriaId":"D3988013-1332-49F8-85E7-7EB59BE36A63"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.6","matchCriteriaId":"CB966EF2-F4F8-4462-AA73-5B452538E756"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.7","matchCriteriaId":"030542CA-76BF-4252-9E03-D7E44D3DEE19"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.38.0","versionEndExcluding":"2.38.5","matchCriteriaId":"6EAEE109-8AD8-4383-AAC3-E9D2A4794F8B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.39.0","versionEndExcluding":"2.39.3","matchCriteriaId":"BE329F8E-076F-4895-A2A2-A1C0330C1F6F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.40.0:*:*:*:*:*:*:*","matchCriteriaId":"89633B46-319A-499C-9848-2EA60AC030EB"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","matchCriteriaId":"E30D0E6F-4AE8-4284-8716-991DFA48CC5D"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","matchCriteriaId":"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2023/04/25/2","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com"},{"url":"http://www.openwall.com/lists/oss-security/2023/04/25/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-29007","sourceIdentifier":"security-advisories@github.com","published":"2023-04-25T21:15:10.403","lastModified":"2026-06-17T05:49:10.607","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`."},{"lang":"es","value":"Git es un sistema de control de revisiones. Antes de las versiones 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3 y 2.40.1, una versión especialmente El archivo `.gitmodules` elaborado con URL de submódulo que tienen más de 1024 caracteres se puede usar para explotar un error en `config.c::git_config_copy_or_rename_section_in_file()`. Este error se puede utilizar para inyectar una configuración arbitraria en `$GIT_DIR/config` de un usuario al intentar eliminar la sección de configuración asociada con ese submódulo. Cuando el atacante inyecta valores de configuración que especifican ejecutables para ejecutar (como `core.pager`, `core.editor`, `core.sshCommand`, etc.), esto puede provocar una ejecución remota de código. Una solución hay una solución disponible en las versiones 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3 y 2.40. .1. Como workaround, evite ejecutar `git submodule deinit` en repositorios que no sean de confianza o sin una inspección previa de cualquier sección de submódulo en `$GIT_DIR/config`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.30.9","status":"affected"},{"version":">= 2.31.0, < 2.31.8","status":"affected"},{"version":">= 2.32.0, < 2.32.7","status":"affected"},{"version":">= 2.33.0, < 2.33.8","status":"affected"},{"version":">= 2.34.0, < 2.34.8","status":"affected"},{"version":">= 2.35.0, < 2.35.8","status":"affected"},{"version":">= 2.36.0, < 2.36.6","status":"affected"},{"version":">= 2.37.0, < 2.37.7","status":"affected"},{"version":">= 2.38.0, < 2.38.5","status":"affected"},{"version":">= 2.39.0, < 2.39.3","status":"affected"},{"version":">= 2.40.0, < 2.40.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.30.9","matchCriteriaId":"A2E4BF99-17B8-4424-B97E-DDB8A4793DAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.31.0","versionEndExcluding":"2.31.8","matchCriteriaId":"2A1D7F29-E06F-4277-8713-1C19DE714300"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndExcluding":"2.32.7","matchCriteriaId":"0B69F022-B29E-4D9A-B4FC-78430AFF0C9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndExcluding":"2.33.8","matchCriteriaId":"8A2B603F-B8E2-4123-80A4-64E983FF1F86"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.34.0","versionEndExcluding":"2.34.8","matchCriteriaId":"26D3ED4E-246E-4D4D-9E2D-7890E93ECED8"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.8","matchCriteriaId":"D3988013-1332-49F8-85E7-7EB59BE36A63"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.5","matchCriteriaId":"0588D372-41D2-442E-976E-6B24DB1A1EC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.37.0","versionEndExcluding":"2.37.7","matchCriteriaId":"030542CA-76BF-4252-9E03-D7E44D3DEE19"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.38.0","versionEndExcluding":"2.38.5","matchCriteriaId":"6EAEE109-8AD8-4383-AAC3-E9D2A4794F8B"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.39.0","versionEndExcluding":"2.39.3","matchCriteriaId":"BE329F8E-076F-4895-A2A2-A1C0330C1F6F"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.40.0:*:*:*:*:*:*:*","matchCriteriaId":"89633B46-319A-499C-9848-2EA60AC030EB"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","matchCriteriaId":"E30D0E6F-4AE8-4284-8716-991DFA48CC5D"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","matchCriteriaId":"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"}]}]}],"references":[{"url":"https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202312-15","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-32004","sourceIdentifier":"security-advisories@github.com","published":"2024-05-14T19:15:11.377","lastModified":"2026-06-17T07:29:06.410","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources."},{"lang":"es","value":"Git es un sistema de control de revisiones. Antes de las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4, un atacante puede preparar un repositorio local de tal manera que, cuando se clone, ejecute código arbitrario durante la operación. El problema se solucionó en las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4. Como workaround, evite clonar repositorios de fuentes que no sean de confianza."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"= 2.45.0","status":"affected"},{"version":"= 2.44.0","status":"affected"},{"version":">= 2.43.0, < 2.43.4","status":"affected"},{"version":">= 2.42.0, < 2.42.2","status":"affected"},{"version":"= 2.41.0","status":"affected"},{"version":">= 2.40.0, < 2.40.2","status":"affected"},{"version":"< 2.39.4","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.45.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.44.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.43.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.43.0","lessThan":"2.43.4","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.42.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.42.0","lessThan":"2.42.2","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.41.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.40.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.40.0","lessThan":"2.40.2","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"2.39.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-15T17:59:29.364044Z","id":"CVE-2024-32004","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-114"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.39.4","matchCriteriaId":"C2816032-589C-4D8A-B4E9-4B48C33E7FF3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.40.0","versionEndExcluding":"2.40.2","matchCriteriaId":"3EFD344C-918A-4827-BD0D-B159EDDB25F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.42.0","versionEndExcluding":"2.42.2","matchCriteriaId":"A50D9AEF-FE0D-47A8-BC4F-E6488035AE12"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.43.0","versionEndExcluding":"2.43.4","matchCriteriaId":"D50CF36C-73C1-4B12-A0CB-612DCFAFC472"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*","matchCriteriaId":"6AB42055-8955-4CDF-843E-5014A84CCBB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*","matchCriteriaId":"E5315926-90D3-4754-908E-C16455DE18E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*","matchCriteriaId":"E5649289-76FB-4A3A-A0DA-EE127EAB4CAE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*","matchCriteriaId":"CA277A6C-83EC-4536-9125-97B84C4FAF59"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/docs/git-clone","source":"security-advisories@github.com","tags":["Technical Description"]},{"url":"https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"security-advisories@github.com","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"security-advisories@github.com","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/docs/git-clone","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-32020","sourceIdentifier":"security-advisories@github.com","published":"2024-05-14T19:15:12.240","lastModified":"2026-06-17T07:29:07.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a \"proper\" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."},{"lang":"es","value":"Git es un sistema de control de revisiones. Antes de las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4, los clones locales pueden terminar vinculando archivos a la base de datos de objetos del repositorio de destino cuando el repositorio de origen y el de destino residen en el mismo disco. Si el repositorio de origen es propiedad de un usuario diferente, el usuario que no es de confianza puede reescribir esos archivos vinculados en cualquier momento. La clonación de repositorios locales hará que Git copie o vincule archivos del repositorio de origen al repositorio de destino. Esto acelera significativamente dichos clones locales en comparación con realizar un clon \"adecuado\" y ahorra espacio en disco y tiempo de cálculo. Al clonar un repositorio ubicado en el mismo disco que es propiedad de un usuario diferente al usuario actual, también terminamos creando dichos enlaces físicos. Estos archivos seguirán siendo propiedad y controlados por el usuario potencialmente no confiable y podrán ser reescritos por él a voluntad en el futuro. El problema se solucionó en las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"= 2.45.0","status":"affected"},{"version":"= 2.44.0","status":"affected"},{"version":">= 2.43.0, < 2.43.4","status":"affected"},{"version":">= 2.42.0, < 2.42.2","status":"affected"},{"version":"= 2.41.0","status":"affected"},{"version":">= 2.40.0, < 2.40.2","status":"affected"},{"version":"< 2.39.4","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"2.39.4","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.45.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.44.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.43:*:*:*:*:*:*:*"],"versions":[{"version":"2.43","lessThan":"2.43.4","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.42.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.42.0","lessThan":"2.42.2","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.41.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:2.40.0:*:*:*:*:*:*:*"],"versions":[{"version":"2.40.0","lessThan":"2.40.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L","baseScore":3.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-15T14:32:40.280977Z","id":"CVE-2024-32020","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-281"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.39.4","matchCriteriaId":"C2816032-589C-4D8A-B4E9-4B48C33E7FF3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.40.0","versionEndExcluding":"2.40.2","matchCriteriaId":"3EFD344C-918A-4827-BD0D-B159EDDB25F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.42.0","versionEndExcluding":"2.42.2","matchCriteriaId":"A50D9AEF-FE0D-47A8-BC4F-E6488035AE12"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.43.0","versionEndExcluding":"2.43.4","matchCriteriaId":"D50CF36C-73C1-4B12-A0CB-612DCFAFC472"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*","matchCriteriaId":"6AB42055-8955-4CDF-843E-5014A84CCBB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*","matchCriteriaId":"E5315926-90D3-4754-908E-C16455DE18E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*","matchCriteriaId":"E5649289-76FB-4A3A-A0DA-EE127EAB4CAE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*","matchCriteriaId":"CA277A6C-83EC-4536-9125-97B84C4FAF59"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-32021","sourceIdentifier":"security-advisories@github.com","published":"2024-05-14T20:15:13.630","lastModified":"2026-06-17T07:29:08.117","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning\nwill be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."},{"lang":"es","value":"Git es un sistema de control de revisiones. Antes de las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4, al clonar un repositorio de origen local que contiene enlaces simbólicos a través del sistema de archivos, Git puede crear enlaces duros a archivos arbitrarios legibles por el usuario en el mismo sistema de archivos que el repositorio de destino en el directorio `objects/`. Clonar un repositorio local sobre el sistema de archivos puede crear enlaces duros a archivos arbitrarios propiedad del usuario en el mismo sistema de archivos en el directorio `objects/` del repositorio Git de destino. Al clonar un repositorio a través del sistema de archivos (sin especificar explícitamente el protocolo `file://` o `--no-local`), se utilizarán las optimizaciones para la clonación local, que incluyen intentar vincular los archivos objeto en lugar de copiarlos. a ellos. Si bien el código incluye verificaciones de enlaces simbólicos en el repositorio de origen, que se agregaron durante la corrección de CVE-2022-39253, estas verificaciones aún se pueden ejecutar porque la operación de enlace físico finalmente sigue enlaces simbólicos. Si el objeto en el sistema de archivos aparece como un archivo durante la verificación, y luego como un enlace simbólico durante la operación, esto permitirá al adversario eludir la verificación y crear vínculos físicos en el directorio de objetos de destino a archivos arbitrarios legibles por el usuario. El problema se solucionó en las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"= 2.45.0","status":"affected"},{"version":"= 2.44.0","status":"affected"},{"version":">= 2.43.0, < 2.43.4","status":"affected"},{"version":">= 2.42.0, < 2.42.2","status":"affected"},{"version":"= 2.41.0","status":"affected"},{"version":">= 2.40.0, < 2.40.2","status":"affected"},{"version":"< 2.39.4","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"2.39.4","versionType":"custom","status":"affected"},{"version":"2.40.0","lessThan":"2.40.2","versionType":"custom","status":"affected"},{"version":"2.41.0","lessThan":"2.41.1","versionType":"custom","status":"affected"},{"version":"2.42.0","lessThan":"2.42.2","versionType":"custom","status":"affected"},{"version":"2.43.0","lessThan":"2.43.4","versionType":"custom","status":"affected"},{"version":"2.44.0","lessThan":"2.44.1","versionType":"custom","status":"affected"},{"version":"2.45.0","lessThan":"2.45.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L","baseScore":3.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-11T20:29:23.147248Z","id":"CVE-2024-32021","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-547"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.39.4","matchCriteriaId":"C2816032-589C-4D8A-B4E9-4B48C33E7FF3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.40.0","versionEndExcluding":"2.40.2","matchCriteriaId":"3EFD344C-918A-4827-BD0D-B159EDDB25F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.42.0","versionEndExcluding":"2.42.2","matchCriteriaId":"A50D9AEF-FE0D-47A8-BC4F-E6488035AE12"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.43.0","versionEndExcluding":"2.43.4","matchCriteriaId":"D50CF36C-73C1-4B12-A0CB-612DCFAFC472"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*","matchCriteriaId":"6AB42055-8955-4CDF-843E-5014A84CCBB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*","matchCriteriaId":"E5315926-90D3-4754-908E-C16455DE18E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*","matchCriteriaId":"E5649289-76FB-4A3A-A0DA-EE127EAB4CAE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*","matchCriteriaId":"CA277A6C-83EC-4536-9125-97B84C4FAF59"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-32465","sourceIdentifier":"security-advisories@github.com","published":"2024-05-14T20:15:14.540","lastModified":"2026-06-17T07:29:40.987","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources."},{"lang":"es","value":"Git es un sistema de control de revisiones. El proyecto Git recomienda evitar trabajar en repositorios que no sean de confianza y, en su lugar, clonarlos primero con `git clone --no-local` para obtener una copia limpia. Git tiene protecciones específicas para que la operación sea segura incluso con un repositorio de origen que no sea de confianza, pero las vulnerabilidades permiten eludir esas protecciones. En el contexto de la clonación de repositorios locales propiedad de otros usuarios, esta vulnerabilidad se cubrió en CVE-2024-32004. Pero hay circunstancias en las que las correcciones para CVE-2024-32004 no son suficientes: por ejemplo, al obtener un archivo `.zip` que contiene una copia completa de un repositorio Git, no se debe confiar en que sea seguro de forma predeterminada, como por ejemplo Los ganchos podrían configurarse para ejecutarse dentro del contexto de ese repositorio. El problema se solucionó en las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4. Como workaround, evite utilizar Git en repositorios que se hayan obtenido a través de archivos de fuentes no confiables."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"= 2.45.0","status":"affected"},{"version":"= 2.44.0","status":"affected"},{"version":">= 2.43.0, < 2.43.4","status":"affected"},{"version":">= 2.42.0, < 2.42.2","status":"affected"},{"version":"= 2.41.0","status":"affected"},{"version":">= 2.40.0, < 2.40.2","status":"affected"},{"version":"< 2.39.4","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.45.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.44.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.43.0","lessThanOrEqual":"2.43.4","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.42.0","lessThanOrEqual":"2.42.2","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.41.0","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.40.0","lessThanOrEqual":"2.40.2","versionType":"custom","status":"affected"}]},{"vendor":"git","product":"git","defaultStatus":"unknown","cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.39.4*","lessThan":"2.39.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-15T14:24:08.045336Z","id":"CVE-2024-32465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.39.4","matchCriteriaId":"C2816032-589C-4D8A-B4E9-4B48C33E7FF3"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.40.0","versionEndExcluding":"2.40.2","matchCriteriaId":"3EFD344C-918A-4827-BD0D-B159EDDB25F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.42.0","versionEndExcluding":"2.42.2","matchCriteriaId":"A50D9AEF-FE0D-47A8-BC4F-E6488035AE12"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.43.0","versionEndExcluding":"2.43.4","matchCriteriaId":"D50CF36C-73C1-4B12-A0CB-612DCFAFC472"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*","matchCriteriaId":"6AB42055-8955-4CDF-843E-5014A84CCBB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*","matchCriteriaId":"E5315926-90D3-4754-908E-C16455DE18E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*","matchCriteriaId":"E5649289-76FB-4A3A-A0DA-EE127EAB4CAE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*","matchCriteriaId":"CA277A6C-83EC-4536-9125-97B84C4FAF59"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/docs/git#_security","source":"security-advisories@github.com","tags":["Technical Description"]},{"url":"https://git-scm.com/docs/git-clone","source":"security-advisories@github.com","tags":["Technical Description"]},{"url":"https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/14/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://git-scm.com/docs/git#_security","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"https://git-scm.com/docs/git-clone","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"]},{"url":"https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-48384","sourceIdentifier":"security-advisories@github.com","published":"2025-07-08T19:15:42.800","lastModified":"2026-09-24T13:10:00.320","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."},{"lang":"es","value":"Git es un sistema de control de versiones distribuido, rápido y escalable, con un conjunto de comandos excepcionalmente completo que proporciona operaciones de alto nivel y acceso completo a su funcionamiento interno. Al leer un valor de configuración, Git elimina cualquier retorno de carro y avance de línea (CRLF) final. Al escribir una entrada de configuración, los valores con un CR final no se entrecomillan, lo que provoca que el CR se pierda al leer la configuración posteriormente. Al inicializar un submódulo, si la ruta del submódulo contiene un CR final, se lee la ruta modificada, lo que provoca que el submódulo se extraiga a una ubicación incorrecta. Si existe un enlace simbólico que apunta la ruta modificada al directorio de ganchos del submódulo, y este contiene un gancho ejecutable posterior a la extracción, el script podría ejecutarse accidentalmente después de la extracción. Esta vulnerabilidad se ha corregido en v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1 y v2.50.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"git","product":"git","versions":[{"version":"< 2.43.7","status":"affected"},{"version":">= 2.44.0-rc0, < 2.44.4","status":"affected"},{"version":">= 2.45.0-rc0, < 2.45.4","status":"affected"},{"version":">= 2.46.0-rc0, < 2.46.4","status":"affected"},{"version":">= 2.47.0-rc0, < 2.47.3","status":"affected"},{"version":">= 2.48.0-rc0, < 2.48.2","status":"affected"},{"version":">= 2.49.0-rc0, < 2.49.1","status":"affected"},{"version":">= 2.50.0-rc0, < 2.50.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-26T03:55:23.181071Z","id":"CVE-2025-48384","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2025-08-25","cisaActionDue":"2025-09-15","cisaRequiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Git Link Following Vulnerability","weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-436"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.43.7","matchCriteriaId":"BB276680-D286-4DF6-BCB7-CAC1D9D77E08"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.44.0","versionEndExcluding":"2.44.4","matchCriteriaId":"856A8970-74E2-4F8F-A1A6-2AB1C0C87E45"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.45.0","versionEndExcluding":"2.45.4","matchCriteriaId":"6D1DB9BA-3D91-4F7D-931E-A664737129F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.46.0","versionEndExcluding":"2.46.4","matchCriteriaId":"01BDA55C-F398-4286-ABC6-979A783BDC65"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.47.0","versionEndExcluding":"2.47.3","matchCriteriaId":"FF4A2ACC-0996-4869-884D-734D6006C032"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.48.0","versionEndExcluding":"2.48.2","matchCriteriaId":"0DD21A83-8D62-4EE4-914B-B5ACA19A84A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.49.0","versionEndExcluding":"2.49.1","matchCriteriaId":"95C1825C-B7A2-46E9-93D7-2D196DB2515E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.50.0","versionEndExcluding":"2.50.1","matchCriteriaId":"18F948AD-22C0-4B2E-B497-899F3A94B70A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"26.0","matchCriteriaId":"37CC7F40-CC3A-4AEB-9260-B621FE64735A"}]}]}],"references":[{"url":"https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Sep/60","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/08/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}