Critical Remote Code Execution Vulnerability in Git Package
Summary
ALPINE-CVE-2019-1350: A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. Affects git versions < 2.22.2-r0. Fixed in 2.22.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, efficiency, and support for distributed, non-linear workflows. However, a critical vulnerability has been identified in Git that could allow remote code execution, posing significant risks to users and their systems.
Vulnerability Detail
A remote code execution vulnerability exists in Git for Visual Studio due to improper input sanitization. This flaw can be exploited by an attacker to execute arbitrary code on the victim's machine, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability is identified as CVE-2019-1350 and has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.22.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Git for Visual Studio until the package is updated. Additionally, users should refrain from executing untrusted code or scripts that could exploit this vulnerability.
Conclusion
The identified vulnerability in the Git package poses a significant risk to users, allowing for potential remote code execution. It is crucial for users to update their Git installations to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for git →
FAQ
CVE-2019-1350 is a remote code execution vulnerability in Git for Visual Studio that allows attackers to execute arbitrary code on a victim's machine.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update Git immediately, avoid using Git for Visual Studio and refrain from executing untrusted code until the patch is applied.
For more information about vulnerabilities, you can visit Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
