Critical Remote Code Execution Vulnerability in Git Package
Summary
ALPINE-CVE-2019-1349: A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. Affects git versions < 2.22.2-r0. Fixed in 2.22.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in their codebase, collaborate with others, and manage project history. It is essential for software development, enabling teams to work efficiently. However, certain versions of Git have been found to have a critical vulnerability that could allow remote code execution, posing significant risks to users and their systems.
Vulnerability Detail
A remote code execution vulnerability exists in Git for Visual Studio due to improper input sanitization. This flaw can be exploited by an attacker to execute arbitrary code on the victim's machine, leading to unauthorized access and potential data breaches. The vulnerability is identified as CVE-2019-1349 and has a CVSS score of 8.8, indicating a high severity level. This vulnerability affects multiple versions of the Git package across various Alpine Linux distributions.
How To Fix
Minimum fixed version
2.22.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of Git for Visual Studio until the package is updated. Additionally, avoid executing untrusted code or scripts that may exploit this vulnerability.
Conclusion
The remote code execution vulnerability in Git for Visual Studio (CVE-2019-1349) poses significant risks to users. It is crucial to update to the patched versions of the Git package to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for git →
FAQ
CVE-2019-1349 is a remote code execution vulnerability in Git for Visual Studio that arises from improper input sanitization.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized code execution, data breaches, and loss of control over the affected system.
Multiple versions of Git across various Alpine Linux distributions are affected, specifically those prior to the patched versions.
If immediate updates are not possible, limit the use of Git for Visual Studio and avoid executing untrusted code until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
