CVE-2018-17456

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-17456
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17456.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-17456
Downstream
Related
Published
2018-10-06T14:29:00.300Z
Modified
2026-02-25T01:14:36.387774Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type
GIT
Repo
https://github.com/git-for-windows/git
Events
Introduced
1d4361b0f344188ab5eec6dcea01f61a3a3a1670
Fixed
cae598d9980661a978e2df4fb338518f7bf09572

Affected versions

v2.*
v2.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17456.json"