Critical severity · published Jan 24, 2020
CVE-2019-1353
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Git · Git-scm
2.14.0 before 2.14.6; 2.15.0 before 2.15.4; 2.16.0 before 2.16.6; 2.17.0 before 2.17.3; 2.18.0 before 2.18.2; 2.19.0 before 2.19.3; +5 more · source: NVD
LE
Leap · Opensuse
15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1353
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
lore.kernel.org
https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
public-inbox.org
https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
security.gentoo.org
https://security.gentoo.org/glsa/202003-30
More from Git
8.0
CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
9.8
CVE-2022-41903
Git is distributed revision control system
9.8
CVE-2022-23521
Git is distributed revision control system
9.8
CVE-2014-9390
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode…
9.8
CVE-2018-19486
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and…