Read the docs
TI-2019-01097 Aliases CVE-2019-1387GHSA-9mhc-h3vf-83fw

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3…

Priority MEDIUM 47Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04426 91st percentileScored 2026-11-07
Fix Fixed Git (Microsoft Corporation): v2.24.1, v2.23.1, v2.22.2 +8Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftGitbefore v2.24.1; before v2.23.1; before v2.22.2; before v2.21.1; before v2.20.2; before v2.19.3; before v2.18.2; before v2.17.3; before v2.16.6; before v2.15.4; before v2.14.6v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, v2.14.6Patch availableCNA
  • Git VendorMicrosoft Affected before v2.24.1; before v2.23.1; before v2.22.2; before v2.21.1; before v2.20.2; before v2.19.3; before v2.18.2; before v2.17.3; before v2.16.6; before v2.15.4; before v2.14.6 Fixed in v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, v2.14.6 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*2.14.0 to before 2.14.6; 2.15.0 to before 2.15.4; 2.16.0 to before 2.16.6; 2.17.0 to before 2.17.3; 2.18.0 to before 2.18.2; 2.19.0 to before 2.19.3; 2.20.0 to before 2.20.2; 2.22.0 to before 2.22.2VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.21.0:*:*:*:*:*:*:*2.21.0VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.23.0:*:*:*:*:*:*:*2.23.0VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.24.0:*:*:*:*:*:*:*2.24.0VulnerableGit-scm
  • cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* Versions 2.14.0 to before 2.14.6; 2.15.0 to before 2.15.4; 2.16.0 to before 2.16.6; 2.17.0 to before 2.17.3; 2.18.0 to before 2.18.2; 2.19.0 to before 2.19.3; 2.20.0 to before 2.20.2; 2.22.0 to before 2.22.2 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.21.0:*:*:*:*:*:*:* Versions 2.21.0 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.23.0:*:*:*:*:*:*:* Versions 2.23.0 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.24.0:*:*:*:*:*:*:* Versions 2.24.0 Vulnerable ·Git-scm

Remediation

  • Fix · CNA Git (Microsoft Corporation) Fixed in v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, v2.14.6

Red Hat 4 advisories

  • RHSA-2020:0228 Released 2020-01-27 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) git-2.18.2-1.el8_0, git-all-2.18.2-1.el8_0, git-core-2.18.2-1.el8_0 +11
  • RHSA-2020:0124 Released 2020-01-16 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux Client Optional (v. 7) emacs-git-1.8.3.1-21.el7_7, emacs-git-el-1.8.3.1-21.el7_7, git-1.8.3.1-21.el7_7 +15
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-git-1.8.3.1-21.el7_7, emacs-git-el-1.8.3.1-21.el7_7, git-1.8.3.1-21.el7_7 +15
    • Red Hat Enterprise Linux Server (v. 7) git-1.8.3.1-21.el7_7, perl-Git-1.8.3.1-21.el7_7
    • Red Hat Enterprise Linux Server Optional (v. 7) emacs-git-1.8.3.1-21.el7_7, emacs-git-el-1.8.3.1-21.el7_7, git-all-1.8.3.1-21.el7_7 +13
    • Red Hat Enterprise Linux Workstation (v. 7) git-1.8.3.1-21.el7_7, perl-Git-1.8.3.1-21.el7_7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-git-1.8.3.1-21.el7_7, emacs-git-el-1.8.3.1-21.el7_7, git-all-1.8.3.1-21.el7_7 +13
  • RHSA-2020:0002 Released 2020-01-02 · Red Hat rating Important
    rh-git218-git security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-git218-git-2.18.2-1.el7, rh-git218-git-all-2.18.2-1.el7, rh-git218-git-core-2.18.2-1.el7 +13
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-git218-git-2.18.2-1.el7, rh-git218-git-all-2.18.2-1.el7, rh-git218-git-core-2.18.2-1.el7 +13
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-git218-git-2.18.2-1.el7, rh-git218-git-all-2.18.2-1.el7, rh-git218-git-core-2.18.2-1.el7 +13
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-git218-git-2.18.2-1.el7, rh-git218-git-all-2.18.2-1.el7, rh-git218-git-core-2.18.2-1.el7 +13
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-git218-git-2.18.2-1.el7, rh-git218-git-all-2.18.2-1.el7, rh-git218-git-core-2.18.2-1.el7 +13
Show 1 more Red Hat advisories
  • RHSA-2019:4356 Released 2019-12-19 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.18.2-1.el8_1, git-all-2.18.2-1.el8_1, git-core-2.18.2-1.el8_1 +11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:4356
Red Hat Enterprise Linux AppStream E4S (v. 8.0)Fixed RHSA-2020:0228
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:0124
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:0124
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:0124
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:0124
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:0124
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:0124
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:0002
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2020:0002
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:0002
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:0002
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:0002
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Fuse 7
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1387
  2. 2026-10-03 Alias added: GHSA-9mhc-h3vf-83fw

References

Advisory 9

Other 4

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences