Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 505
Alerts This Week
Warning Icon 1 505

SUSE Linux Enterprise: 2020:0045-1 Important: Git Remote Code Execution

suse
Calendar Grey January 8, 2020
Scroller Suse
SUSE Security Update: Security update for git ______________________________________________________
An update that solves 9 vulnerabilities and has two fixes is now available

Summary

This update for git fixes the following issues: Security issues fixed: - CVE-2019-1349: Fixed issue on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice (bsc#1158787). - CVE-2019-19604: Fixed a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that (bsc#1158795). - CVE-2019-1387: Fixed recursive clones that are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones (bsc#1158793). - CVE-2019-1354: Fixed issue on Windows that refuses to write tracked files with filenames that contain backslashes (bsc#1158792).

Topics%20covered

Topics Covered

security advisory security issue remote code execution bug fix important git SUSE Linux Enterprise

References

#1082023 #1149792 #1158785 #1158787 #1158788

#1158789 #1158790 #1158791 #1158792 #1158793

#1158795

Cross- CVE-2019-1348 CVE-2019-1349 CVE-2019-1350

CVE-2019-1351 CVE-2019-1352 CVE-2019-1353

CVE-2019-1354 CVE-2019-1387 CVE-2019-19604

Affected Products:

SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1

SUSE Linux Enterprise Module for Open Buildservice Development Tools 15

SUSE Linux Enterprise Module for Development Tools 15-SP1

SUSE Linux Enterprise Module for Development Tools 15

SUSE Linux Enterprise Module for Basesystem 15-SP1

SUSE Linux Enterprise Module for Basesystem 15

https://www.suse.com/security/cve/CVE-2019-1348.html

https://www.suse.com/security/cve/CVE-2019-1349.html

https://www.suse.com/security/cve/CVE-2019-1350.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2020:0045-1
Rating: important

Topics%20covered

Topics Covered

security advisory security issue remote code execution bug fix important git SUSE Linux Enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.