9.8

CVE-2019-1353: git-scm git

CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2019-1353UBUNTU-CVE-2019-1353DEBIAN-CVE-2019-1353
Published 24-01-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2019-1353 is a critical (CVSS 9.8) vulnerability in git-scm git. EPSS estimates a 2.24% chance of exploitation in the next 30 days, higher than 82.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
2.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8
DLA-2059-1DSA-4581-1OPENSUSE-SU-2020:0123-1OPENSUSE-SU-2020:0598-1OPENSUSE-SU-2024:10786-1OPENSUSE-SU-2024:10943-1

Timeline

  1. 24-01-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

2.24%

Chance of exploitation in the next 30 days

Percentile

83%

Versus all other CVEs

30-day change

0.00 pp

From 2.24% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Alpine2 products
  • git≥ 2.14.0, < 2.22.2-r0 | ≥ 2.14.0, < 2.24.1-r0 | ≥ 2.14.0, < 2.15.4-r0 | ≥ 2.14.0, < 2.18.2-r0 | ≥ 2.14.0, < 2.20.2-r0
  • libgit2< 0.28.4-r0
Debian1 product
  • git< 1:2.24.0-2
Git-scm1 product
  • git≥ 2.14.0, < 2.14.6 | ≥ 2.15.0, < 2.15.4 | ≥ 2.16.0, < 2.16.6 | ≥ 2.17.0, < 2.17.3 | ≥ 2.18.0, < 2.18.2 | ≥ 2.19.0, < 2.19.3 | ≥ 2.20.0, < 2.20.2 | ≥ 2.21.0, < 2.21.1 | ≥ 2.22.0, < 2.22.2 | ≥ 2.23.0, < 2.23.1 | ≥ 2.24.0, < 2.24.1
Microsoft corporation1 product
  • git< 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6
Opensuse1 product
Ubuntu1 product
  • git< 1:2.7.4-0ubuntu1.7 | < 1:2.17.1-1ubuntu0.5

6 vendors · 7 products

References

11 links
Show all 11 references