CVE-2018-19486
Fixed in a distro release EPSS 4%
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
Products: git-scm git, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.6 | git | 2.13.7-r2 |
| Alpine 3.8 | git | 2.18.1-r1 |
| Amazon Linux 2 | git | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-all | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-core | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-core-doc | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-cvs | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-daemon | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-email | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-gui | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-p4 | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-subtree | 2.17.2-2.amzn2 |
| Amazon Linux 2 | git-svn | 2.17.2-2.amzn2 |
| Amazon Linux 2 | gitk | 2.17.2-2.amzn2 |
| Amazon Linux 2 | gitweb | 2.17.2-2.amzn2 |
| Amazon Linux 2 | perl-Git | 2.17.2-2.amzn2 |
| Amazon Linux 2 | perl-Git-SVN | 2.17.2-2.amzn2 |
| Debian 12 | git | 1:2.19.2-1 |
| Debian 13 | git | 1:2.19.2-1 |
| Debian 14 | git | 1:2.19.2-1 |
| Red Hat rhel software collections 3 | rh-git218-git | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-all | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-core | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-core-doc | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-cvs | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-daemon | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-debuginfo | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-email | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-gui | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-instaweb | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-p4 | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-subtree | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-git-svn | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-gitk | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-gitweb | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-perl-Git | 0:2.18.1-3.el7 |
| Red Hat rhel software collections 3 | rh-git218-perl-Git-SVN | 0:2.18.1-3.el7 |
| SUSE Linux Enterprise Module for Basesystem 15 | git | 2.16.4-3.9.2 |
| SUSE Linux Enterprise Module for Development Tools 15 | git | 2.16.4-3.9.2 |
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.10 |
| Ubuntu 16.04 LTS | git | 1:2.7.4-0ubuntu1.6 |
| Ubuntu 18.04 LTS | git | 1:2.17.1-1ubuntu0.4 |
| openSUSE Tumbleweed | git | 2.33.0-1.3 |