According to the versions of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Arbitrary command execution is possible in Git before     2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2,     2.23.x before 2.23.1, and 2.24.x before 2.24.1 because     a 'git submodule update' operation can run commands     found in the .gitmodules file of a malicious     repository.(CVE-2019-19604)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. Recursive clones are     currently affected by a vulnerability that is caused by     too-lax validation of submodule names, allowing very     targeted attacks via remote code execution in recursive     clones.(CVE-2019-1387)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352,     CVE-2019-1387.(CVE-2019-1354)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the     Windows Subsystem for Linux (also known as 'WSL') while     accessing a working directory on a regular Windows     drive, none of the NTFS protections were     active.(CVE-2019-1353)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1352)

  - A tampering vulnerability exists when Git for Visual     Studio improperly handles virtual drive paths, aka 'Git     for Visual Studio Tampering     Vulnerability'.(CVE-2019-1351)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1350)

  - A remote code execution vulnerability exists when Git     for Visual Studio improperly sanitizes input, aka 'Git     for Visual Studio Remote Code Execution Vulnerability'.
    This CVE ID is unique from CVE-2019-1350,     CVE-2019-1352, CVE-2019-1354,     CVE-2019-1387.(CVE-2019-1349)

  - An issue was found in Git before v2.24.1, v2.23.1,     v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. The --export-marks     option of git fast-import is exposed also via the     in-stream command feature export-marks=... and it     allows overwriting arbitrary paths.(CVE-2019-1348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2818 advisory.

    A flaw was found in the git fast-import command where it provides the export-marks feature that may     unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input     passed to the fast-import command by using the export-marks feature and overwrite arbitrary files, but     would not have complete control on the content of the file. (CVE-2019-1348)

    An improper input validation flaw was discovered in git in the way it handles git submodules. A remote     attacker could abuse this flaw to trick a victim user into recursively cloning a malicious repository,     which, under certain circumstances, could fool git into using the same git directory twice and potentially     cause remote code execution. (CVE-2019-1349)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1350)

    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka     'Git for Visual Studio Tampering Vulnerability'. (CVE-2019-1351)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

    An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1352, CVE-2019-1387. (CVE-2019-1354)

    A flaw was discovered where git improperly validates submodules' names used to construct git metadata     paths and does not prevent them from being nested in existing directories used to store another     submodule's metadata. A remote attacker could abuse this flaw to trick a victim user into cloning a     malicious repository containing submodules, which, when recursively cloned, would trigger the flaw and     remotely execute code on the victim's machine. (CVE-2019-1387)

    A security bypass was discovered in git, which allows arbitrary commands to be executed during the update     of git submodules. A remote attacker may trick a victim user into cloning a malicious repository that     initially looks fine, allowing access to bypass the security mechanisms that prevent the execution of     arbitrary commands during the submodule initialization. After following an update of the repository and     the submodules done by the victim user, vulnerable versions of git may use the update setting in the     .gitmodules file and execute arbitrary commands. (CVE-2019-19604)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4220-1 advisory.

    Joern Schneeweisz and Nicolas Joly discovered that Git contained various security flaws. An attacker could     possibly use these issues to overwrite arbitrary paths, execute arbitrary code, and overwrite files in the     .git directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning (CVE-2019-1351)

NTFS protections inactive when running Git in the Windows Subsystem for Linux (CVE-2019-1353)

remote code execution in recursive clones with nested submodules (CVE-2019-1387)

Arbitrary path overwriting via export-marks command option (CVE-2019-1348)

Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams (CVE-2019-1352)

recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ (CVE-2019-1349)

Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone (CVE-2019-1350)

Git does not refuse to write out tracked files with backlashes in filenames (CVE-2019-1354)

Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a 'git submodule update' operation can run commands found in the .gitmodules file of a malicious repository.(CVE-2019-19604)

Per the upstream release announcement&sup1;, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE identifiers.'

Refer to the 2.14.6 release notes&sup2; for details on these vulnerabilities.

&sup1;
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com / &sup2;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git fixes the following issues :

Security issues fixed :

CVE-2019-1349: Fixed issue on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice (bsc#1158787).

CVE-2019-19604: Fixed a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that (bsc#1158795).

CVE-2019-1387: Fixed recursive clones that are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones (bsc#1158793).

CVE-2019-1354: Fixed issue on Windows that refuses to write tracked files with filenames that contain backslashes (bsc#1158792).

CVE-2019-1353: Fixed issue when run in the Windows Subsystem for Linux while accessing a working directory on a regular Windows drive, none of the NTFS protections were active (bsc#1158791).

CVE-2019-1352: Fixed issue on Windows was unaware of NTFS Alternate Data Streams (bsc#1158790).

CVE-2019-1351: Fixed issue on Windows mistakes drive letters outside of the US-English alphabet as relative paths (bsc#1158789).

CVE-2019-1350: Fixed incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs (bsc#1158788).

CVE-2019-1348: Fixed the --export-marks option of fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths (bsc#1158785).

Fixes an issue where git send-email failed to authenticate with SMTP server (bsc#1082023)

Bug fixes: Add zlib dependency, which used to be provided by openssl-devel, so that package can compile successfully after openssl upgrade to 1.1.1. (bsc#1149792).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-30 (Git: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Git. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly overwrite arbitrary paths, execute arbitrary       code, and overwrite files in the .git directory.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135148	EulerOS Virtualization for ARM 64 3.0.6.0 : git (EulerOS-SA-2020-1361)	Nessus	Huawei Local Security Checks	2020/4/2	2024/3/20	critical
234508	Amazon Linux 2 : git (ALAS-2025-2818)	Nessus	Amazon Linux Local Security Checks	2025/4/17	2025/10/30	critical
135580	SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)	Nessus	SuSE Local Security Checks	2020/4/15	2022/5/13	critical
132015	Ubuntu 16.04 LTS / 18.04 LTS : Git vulnerabilities (USN-4220-1)	Nessus	Ubuntu Local Security Checks	2019/12/12	2024/8/27	critical
132259	Amazon Linux 2 : git (ALAS-2019-1371)	Nessus	Amazon Linux Local Security Checks	2019/12/19	2024/4/3	critical
132639	Fedora 30 : git (2019-1cec196e20)	Nessus	Fedora Local Security Checks	2020/1/6	2024/4/1	critical
132745	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2020:0045-1)	Nessus	SuSE Local Security Checks	2020/1/9	2024/4/1	critical
134607	GLSA-202003-30 : Git: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/16	2024/3/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical