CVE-2019-1348 Path traversal in Git

What is CVE-2019-1348?

CVE-2019-1348 is a low-severity path traversal vulnerability in Opensuse Leap, published on 24 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

Which versions are affected by CVE-2019-1348?

It affects 2 products.

Products include Git-Scm Git, Opensuse Leap.

How do I fix CVE-2019-1348?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-1348 being exploited?

There is no known exploitation of CVE-2019-1348 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Leap

• CVE-2022-23521 gitattributes parsing integer overflow in git Critical 9.8
• CVE-2022-41903 Integer overflow in `git archive`, `git log --format` leading to RCE in git Critical 9.8
• CVE-2019-1353 Security feature bypass in Git Critical 9.8
• CVE-2016-2315 Memory corruption in n/a Critical 9.8
• CVE-2016-2324 Integer overflow in n/a Critical 9.8

All Opensuse Leap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as ALPINE-CVE-2019-1348, CLEANSTART-2025-GZ59360, DEBIAN-CVE-2019-1348, UBUNTU-CVE-2019-1348.