CVE-2019-1353 Security feature bypass in Git

What is CVE-2019-1353?

CVE-2019-1353 is a critical vulnerability in Opensuse Leap, published on 24 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

Which versions are affected by CVE-2019-1353?

It affects 2 products.

Products include Git-Scm Git, Opensuse Leap.

How do I fix CVE-2019-1353?

Upgrade to a fixed version.

Is CVE-2019-1353 being exploited?

There is no known exploitation of CVE-2019-1353 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Leap

• CVE-2022-23521 gitattributes parsing integer overflow in git Critical 9.8
• CVE-2022-41903 Integer overflow in `git archive`, `git log --format` leading to RCE in git Critical 9.8
• CVE-2016-2315 Memory corruption in n/a Critical 9.8
• CVE-2016-2324 Integer overflow in n/a Critical 9.8
• CVE-2019-1387 Command injection in Git High 8.8

All Opensuse Leap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as ALPINE-CVE-2019-1353, CLEANSTART-2026-WE62542, DEBIAN-CVE-2019-1353, UBUNTU-CVE-2019-1353.