NVD Vulnerability Detail

CVE-2019-1348

Summary	An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.
Publication Date	Jan. 25, 2020, 7:15 a.m.
Registration Date	Jan. 26, 2021, 11:38 a.m.
Last Update	Nov. 21, 2024, 1:36 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
4	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
5	https://access.redhat.com/errata/RHSA-2020:0228	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2020:0228	Third Party Advisory
7	https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
8	https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
9	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
10	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
11	https://security.gentoo.org/glsa/202003-30
12	https://security.gentoo.org/glsa/202003-30
13	https://security.gentoo.org/glsa/202003-42
14	https://security.gentoo.org/glsa/202003-42
15	https://support.apple.com/kb/HT210729
16	https://support.apple.com/kb/HT210729

Common Vulnerabilities List

JVN Vulnerability Information

Git における入力確認に関する脆弱性

Title	Git における入力確認に関する脆弱性
Summary	Git には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 10, 2019, midnight
Registration Date	Feb. 13, 2020, 12:29 p.m.
Last Update	Feb. 13, 2020, 12:29 p.m.

Affected System

openSUSE project

openSUSE Leap

Git project

Git 2.14.6 未満

Git 2.15.4 未満

Git 2.16.6 未満

Git 2.17.3 未満

Git 2.18.2 未満

Git 2.19.3 未満

Git 2.20.2 未満

Git 2.21.1 未満

Git 2.22.2 未満

Git 2.23.1 未満

Git 2.24.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-1348	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1348
National Vulnerability Database (NVD)
2	CVE-2019-1348	https://nvd.nist.gov/vuln/detail/CVE-2019-1348

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
GitHub
1	Git	https://github.com/git/git
opensuse-security-announce
2	openSUSE-SU-2020:0123-1	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html

その他

No	Name	URL
関連文書
1	[ANNOUNCE] Git v2.24.1 and others	https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/

Change Log

No	Changed Details	Date of change
1	[2020年02月13日] 掲載	Feb. 13, 2020, 12:29 p.m.