Git Tampering Vulnerability in Alpine Packages: CVE-2019-1351
Summary
ALPINE-CVE-2019-1351: A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. Affects git versions < 2.22.2-r0. Fixed in 2.22.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in their codebase. It is essential for collaborative software development, enabling multiple users to work on the same project without conflicts. The vulnerability in question affects various versions of the Git package in Alpine Linux, which is a lightweight Linux distribution popular for its simplicity and security. This vulnerability can lead to unauthorized tampering with virtual drive paths, potentially compromising the integrity of the software.
Vulnerability Detail
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, allowing an attacker to manipulate the Git environment. This can lead to unauthorized access or modification of repositories, posing a significant risk to the integrity of the code. The vulnerability is identified as CVE-2019-1351 and has a CVSS score of 7.5, indicating a high level of severity. It affects multiple versions of the Git package across various Alpine Linux releases.
How To Fix
Minimum fixed version
2.22.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using virtual drive paths in their Git operations until the package is updated. This may involve modifying scripts or configurations that rely on these paths.
Conclusion
The Git tampering vulnerability (CVE-2019-1351) poses a significant risk to users of Alpine Linux. It is crucial to update the affected Git package to the patched version to mitigate potential threats. Users should also consider using Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for git →
FAQ
CVE-2019-1351 is a vulnerability in Git for Visual Studio that allows tampering with virtual drive paths, potentially compromising the integrity of repositories.
The vulnerability affects multiple versions of Git in Alpine Linux, specifically versions prior to 2.22.2-r0 for v3.10 and 2.24.1-r0 for v3.11 and later.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, avoid using virtual drive paths in your Git operations as a temporary workaround.
The CVSS score of CVE-2019-1351 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
