{"affected":[{"affectedData":[{"product":"Git","vendor":"Microsoft Corporation","versions":[{"status":"affected","version":"Before v2.24.1"},{"status":"affected","version":"Before v2.23.1"},{"status":"affected","version":"Before v2.22.2"},{"status":"affected","version":"Before v2.21.1"},{"status":"affected","version":"Before v2.20.2"},{"status":"affected","version":"Before v2.19.3"},{"status":"affected","version":"Before v2.18.2"},{"status":"affected","version":"Before v2.17.3"},{"status":"affected","version":"Before v2.16.6"},{"status":"affected","version":"Before v2.15.4"},{"status":"affected","version":"Before v2.14.6"}]}],"source":"secure@microsoft.com"},{"affectedData":[{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"git","vendor":"git","versions":[{"lessThan":"2,24.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.23.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.22.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.21.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.20.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.19.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.18.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.17.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.16.6","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.15.4","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2.14.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"CD0FE176-63B7-4176-8319-80CD3D7C524E","versionEndExcluding":"2.14.6","versionStartIncluding":"2.14.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"7FA79B4D-1A29-4520-ACF7-BBD5B2696ABA","versionEndExcluding":"2.15.4","versionStartIncluding":"2.15.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"DB018182-B15F-47BC-85FA-6847BB37844A","versionEndExcluding":"2.16.6","versionStartIncluding":"2.16.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"19CF821B-9ECC-4F6C-B0BC-7361370776C5","versionEndExcluding":"2.17.3","versionStartIncluding":"2.17.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"84278A89-0D1B-4CFD-9B31-68D8D7327E65","versionEndExcluding":"2.18.2","versionStartIncluding":"2.18.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"7B4FA857-692C-4C00-A170-1F31E6D9563E","versionEndExcluding":"2.19.3","versionStartIncluding":"2.19.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"BD4C8899-C9E7-4DFC-BE17-D5D67B9B5FFB","versionEndExcluding":"2.20.2","versionStartIncluding":"2.20.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","matchCriteriaId":"025C10E9-40A6-408C-AE2C-5FC55E788775","versionEndExcluding":"2.22.2","versionStartIncluding":"2.22.0","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:2.21.0:*:*:*:*:*:*:*","matchCriteriaId":"A2FDF378-11FC-414D-8F4B-04BE6269C49A","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:2.23.0:*:*:*:*:*:*:*","matchCriteriaId":"018467BF-01DC-40EE-99F4-0E8375A615DC","vulnerable":true},{"criteria":"cpe:2.3:a:git-scm:git:2.24.0:*:*:*:*:*:*:*","matchCriteriaId":"B977B43D-A0F8-4367-8BA4-96C12CF10002","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones."},{"lang":"es","value":"Se encontró un problema en Git versiones anteriores a v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4 y v2. 14.6. Los clones recursivos están actualmente afectados por una vulnerabilidad causada por una comprobación too-lax de los nombres de submódulos, permitiendo ataques muy específicos por medio de una ejecución de código remota en clones recursivos."}],"id":"CVE-2019-1387","lastModified":"2026-06-17T02:28:30.630","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":6.8,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.6,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2019-1387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-19T18:49:36.663475Z","version":"2.0.3"}}]},"published":"2019-12-18T21:15:13.820","references":[{"source":"secure@microsoft.com","url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html"},{"source":"secure@microsoft.com","url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html"},{"source":"secure@microsoft.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:4356"},{"source":"secure@microsoft.com","url":"https://access.redhat.com/errata/RHSA-2020:0002"},{"source":"secure@microsoft.com","url":"https://access.redhat.com/errata/RHSA-2020:0124"},{"source":"secure@microsoft.com","url":"https://access.redhat.com/errata/RHSA-2020:0228"},{"source":"secure@microsoft.com","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html"},{"source":"secure@microsoft.com","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"},{"source":"secure@microsoft.com","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/"},{"source":"secure@microsoft.com","url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u"},{"source":"secure@microsoft.com","url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/"},{"source":"secure@microsoft.com","url":"https://security.gentoo.org/glsa/202003-30"},{"source":"secure@microsoft.com","url":"https://security.gentoo.org/glsa/202003-42"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:4356"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2020:0002"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2020:0124"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2020:0228"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://security.gentoo.org/glsa/202003-30"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://security.gentoo.org/glsa/202003-42"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}