CVE-2019-19604: debian debian_linux OS Command Injection
CVSS: 9.3v2.0HighModified
AliasesALPINE-CVE-2019-19604DEBIAN-CVE-2019-19604
Published 10-12-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-19604 is a high (CVSS 9.3) OS Command Injection vulnerability in debian debian_linux. EPSS estimates a 3.71% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
3.71%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 10-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.8Preferred score · OSV · Alpine (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
High 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
3.71%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
+0.02 pp
From 3.69% on 18-09-2026
18-09-202618-10-2026
EPSS score3.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Debian2 products
- git< 1:2.24.0-2
- debian_linuxEOL9.0 | 10.0
Alpine1 product
- git≥ 2.21.0, < 2.22.2-r0 | ≥ 2.21.0, < 2.24.1-r0
Fedoraproject1 product
- fedoraEOL30 | 31
Git-scm1 product
- git< 2.20.0 | ≥ 2.21.0, < 2.21.1 | ≥ 2.22.0, < 2.22.2 | ≥ 2.23.0, < 2.23.1 | ≥ 2.24.0, < 2.24.1
Opensuse1 product
- leapEOL15.1
5 vendors · 6 products
References
12 links- gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.mdX Refsource MISCExploitThird Party Advisory
- raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txtX Refsource CONFIRMThird Party Advisory
- public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/X Refsource CONFIRM
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory