Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
[
{
"id": "CVE-2019-19604-110058cf",
"digest": {
"line_hashes": [
"314063613440133364968241956541393809413",
"30487905495825431479410961453100445665",
"99520055215001114197843281127357607861",
"328861464050264078735410652481867155703",
"272151142532519372506526500442316227381",
"155513825299179170875166673260629730996",
"295839117070612124080749434200934686437",
"303468161808983166457410821448389193749",
"294225036012237767797764915428531222649"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "builtin/stash.c"
},
"source": "https://github.com/git-for-windows/git/commit/95155834166f64fe9666f2c0a4909f076080893a",
"signature_version": "v1"
},
{
"id": "CVE-2019-19604-b1e79563",
"digest": {
"function_hash": "25375826845929790786270399599838295779",
"length": 2330.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "do_apply_stash",
"file": "builtin/stash.c"
},
"source": "https://github.com/git-for-windows/git/commit/95155834166f64fe9666f2c0a4909f076080893a",
"signature_version": "v1"
}
]