远程 CentOS Linux 7 主机上安装的多个程序包受到 RHSA-2020:0124 公告中提及的一个漏洞影响。

  - 在 v2.24.1、v2.23.1、v2.22.2、v2.21.1、v2.20.2、v2.19.3、v2.18.2、v2.17.3、v2.16.6、v2.15.4 和 v2.14.6 之前版本的 Git 中发现了一个问题。目前，递归克隆受到一个漏洞的影响，原因是对子模块名称的验证过于松散，导致可以在递归克隆中通过远程代码执行进行非常有针对性的攻击。(CVE-2019-1387)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Per the upstream release announcement&sup1;, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE identifiers.'

Refer to the 2.14.6 release notes&sup2; for details on these vulnerabilities.

&sup1;
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com / &sup2;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the git package has been released.

Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system.

  - CVE-2019-1348     It was reported that the --export-marks option of git     fast-import is exposed also via the in-stream command     feature export-marks=..., allowing to overwrite     arbitrary paths.

  - CVE-2019-1387     It was discovered that submodule names are not validated     strictly enough, allowing very targeted attacks via     remote code execution when performing recursive clones.

  - CVE-2019-19604     Joern Schneeweisz reported a vulnerability, where a     recursive clone followed by a submodule update could     execute code contained within the repository without the     user explicitly having asked for that. It is now     disallowed for `.gitmodules` to have entries that set     `submodule.<name>.update=!command`.

In addition this update addresses a number of security issues which are only an issue if git is operating on an NTFS filesystem (CVE-2019-1349, CVE-2019-1352 and CVE-2019-1353 ).

This is a security release fixing the following issues :

  - CVE-2019-1348: the fast-import stream command 'feature     export-marks=path' allows writing to arbitrary file     paths. As libgit2 does not offer any interface for     fast-import, it is not susceptible to this     vulnerability.

  - CVE-2019-1349: by using NTFS 8.3 short names,     backslashes or alternate filesystreams, it is possible     to cause submodules to be written into pre-existing     directories during a recursive clone using git. As     libgit2 rejects cloning into non-empty directories by     default, it is not susceptible to this vulnerability.

  - CVE-2019-1350: recursive clones may lead to arbitrary     remote code executing due to improper quoting of command     line arguments. As libgit2 uses libssh2, which does not     require us to perform command line parsing, it is not     susceptible to this vulnerability.

  - CVE-2019-1351: Windows provides the ability to     substitute drive letters with arbitrary letters,     including multi-byte Unicode letters. To fix any     potential issues arising from interpreting such paths as     relative paths, we have extended detection of DOS drive     prefixes to accomodate for such cases.

  - CVE-2019-1352: by using NTFS-style alternative file     streams for the '.git' directory, it is possible to     overwrite parts of the repository. While this has been     fixed in the past for Windows, the same vulnerability     may also exist on other systems that write to NTFS     filesystems. We now reject any paths starting with     '.git:' on all systems.

  - CVE-2019-1353: by using NTFS-style 8.3 short names, it     was possible to write to the '.git' directory and thus     overwrite parts of the repository, leading to possible     remote code execution. While this problem was already     fixed in the past for Windows, other systems accessing     NTFS filesystems are vulnerable to this issue too. We     now enable NTFS protecions by default on all systems to     fix this attack vector.

  - CVE-2019-1354: on Windows, backslashes are not a valid     part of a filename but are instead interpreted as     directory separators. As other platforms allowed to use     such paths, it was possible to write such invalid     entries into a Git repository and was thus an attack     vector to write into the '.git' dierctory. We now reject     any entries starting with '.git' on all systems.

  - CVE-2019-1387: it is possible to let a submodule's git     directory point into a sibling's submodule directory,     which may result in overwriting parts of the Git     repository and thus lead to arbitrary command execution.
    As libgit2 doesn't provide any way to do submodule     clones natively, it is not susceptible to this     vulnerability. Users of libgit2 that have implemented     recursive submodule clones manually are encouraged to     review their implementation for this vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0228 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    The following packages have been upgraded to a later upstream version: git (2.18.2). (BZ#1784057)

    Security Fix(es):

    * git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

    * git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

    * git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

    * git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams     (CVE-2019-1352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-42 (libgit2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libgit2. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly overwrite arbitrary paths, execute arbitrary       code, and overwrite files in the .git directory.
  Workaround :

    There is no known workaround at this time.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4356 advisory.

  - git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

  - git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

  - git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams     (CVE-2019-1352)

  - git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1943 advisory.

    A flaw was found in the git fast-import command where it provides the export-marks feature that may     unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input     passed to the fast-import command by using the export-marks feature and overwrite arbitrary files, but     would not have complete control on the content of the file. (CVE-2019-1348)

    An improper input validation flaw was discovered in git in the way it handles git submodules. A remote     attacker could abuse this flaw to trick a victim user into recursively cloning a malicious repository,     which, under certain circumstances, could fool git into using the same git directory twice and potentially     cause remote code execution. (CVE-2019-1349)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1350)

    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka     'Git for Visual Studio Tampering Vulnerability'. (CVE-2019-1351)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

    An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352, CVE-2019-1387. (CVE-2019-1354)

    A flaw was discovered where git improperly validates submodules' names used to construct git metadata     paths and does not prevent them from being nested in existing directories used to store another     submodule's metadata. A remote attacker could abuse this flaw to trick a victim user into cloning a     malicious repository containing submodules, which, when recursively cloned, would trigger the flaw and     remotely execute code on the victim's machine. (CVE-2019-1387)

    A security bypass was discovered in git, which allows arbitrary commands to be executed during the update     of git submodules. A remote attacker may trick a victim user into cloning a malicious repository that     initially looks fine, allowing access to bypass the security mechanisms that prevent the execution of     arbitrary commands during the submodule initialization. After following an update of the repository and     the submodules done by the victim user, vulnerable versions of git may use the update setting in the     .gitmodules file and execute arbitrary commands. (CVE-2019-19604)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0109 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-1351:
    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka     'Git for Visual Studio Tampering Vulnerability'.

    CVE-2019-1354:
    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.

    CVE-2019-1387:
    An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused     by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in     recursive clones.

    CVE-2020-5260:
    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

    CVE-2020-11008:
    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0124 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has git packages installed that are affected by multiple vulnerabilities:

  - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused     by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in     recursive clones. (CVE-2019-1387)

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0124 advisory.

  - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused     by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in     recursive clones. (CVE-2019-1387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
133100	CentOS 7：git (RHSA-2020:0124)	Nessus	CentOS Local Security Checks	2020/1/21	2024/10/9	high
132639	Fedora 30 : git (2019-1cec196e20)	Nessus	Fedora Local Security Checks	2020/1/6	2024/4/1	critical
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	2025/8/19	2025/8/23	critical
131966	Debian DSA-4581-1 : git - security update	Nessus	Debian Local Security Checks	2019/12/12	2024/4/4	critical
132084	Fedora 31 : libgit2 (2019-9c3d054f39)	Nessus	Fedora Local Security Checks	2019/12/17	2024/4/4	critical
133281	RHEL 8 : git (RHSA-2020:0228)	Nessus	Red Hat Local Security Checks	2020/1/28	2024/11/7	high
134728	GLSA-202003-42 : libgit2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/20	2024/3/21	high
145577	CentOS 8 : git (CESA-2019:4356)	Nessus	CentOS Local Security Checks	2021/1/29	2024/1/25	high
171819	Amazon Linux 2 : git (ALAS-2023-1943)	Nessus	Amazon Linux Local Security Checks	2023/2/23	2024/12/11	critical
236541	Alibaba Cloud Linux 3 : 0109: git (ALINUX3-SA-2022:0109)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
133025	RHEL 7 : git (RHSA-2020:0124)	Nessus	Red Hat Local Security Checks	2020/1/17	2024/11/7	high
143890	NewStart CGSL CORE 5.05 / MAIN 5.05 : git Multiple Vulnerabilities (NS-SA-2020-0113)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2020/12/10	high
133100	CentOS 7 : git (RHSA-2020:0124)	Nessus	CentOS Local Security Checks	2020/1/21	2024/10/9	high

偵測

搜尋 Plugin

high

critical

critical

critical

critical

high

high

high

critical

high

high

high

high