CVE catalog

CVE-2019-1352

git: CVE-2019-1352

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
24.01% · Oct 25, 2026

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangitsid1:2.55.0-1fixed
Debiangitforky1:2.53.0-1fixed
Debiangittrixie1:2.47.3-0+deb13u1fixed
Debiangitbookworm1:2.39.5-0+deb12u3fixed
Debiangitbookworm-security1:2.39.5-0+deb12u2fixed
Alpinegit3.102.22.2-r0fixed
Alpinegit3.112.24.1-r0fixed
Alpinegit3.122.24.1-r0fixed
Alpinegit3.132.24.1-r0fixed
Alpinegit3.142.24.1-r0fixed
Alpinegit3.152.24.1-r0fixed
Alpinegit3.162.24.1-r0fixed
Alpinegit3.172.24.1-r0fixed
Alpinegit3.182.24.1-r0fixed
Alpinegit3.192.24.1-r0fixed
Alpinegit3.202.24.1-r0fixed
Alpinegit3.212.24.1-r0fixed
Alpinegit3.222.24.1-r0fixed
Alpinegit3.232.24.1-r0fixed
Alpinegit3.242.24.1-r0fixed
Alpinegit3.72.15.4-r0fixed
Alpinegit3.82.18.2-r0fixed
Alpinegit3.92.20.2-r0fixed
Alpinelibgit23.110.28.4-r0fixed
Suselibgit2linux enterprise high performance computing 15-espos0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise high performance computing 15-ltss0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise high performance computing 15 sp1-espos0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise high performance computing 15 sp1-ltss0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise high performance computing 15 sp2-espos0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise high performance computing 15 sp2-ltss0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server 15-ltss0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server 15 sp1-bcl0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server 15 sp1-ltss0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server 15 sp2-bcl0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server 15 sp2-ltss0.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server for sap applications 150.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server for sap applications 15 sp10.26.8-150000.3.15.1fixed
Suselibgit2linux enterprise server for sap applications 15 sp20.26.8-150000.3.15.1fixed
Suselibgit2manager proxy 4.10.26.8-150000.3.15.1fixed
Suselibgit2manager retail branch server 4.10.26.8-150000.3.15.1fixed
Suselibgit2manager server 4.10.26.8-150000.3.15.1fixed
Suselibgit2enterprise storage 60.26.8-150000.3.15.1fixed
Suselibgit2enterprise storage 70.26.8-150000.3.15.1fixed
Opensuselibgit2leap 15.30.26.8-150000.3.15.1fixed
Opensuselibgit2leap 15.40.26.8-150000.3.15.1fixed
Ubuntugit16.041:2.5.0-1vulnerable
Ubuntugit16.041:2.6.2-1vulnerable
Ubuntugit16.041:2.6.3-1vulnerable
Ubuntugit16.041:2.6.4-1vulnerable
Ubuntugit16.041:2.7.0~rc3-1vulnerable
Ubuntugit16.041:2.7.0-1vulnerable
Ubuntugit16.041:2.7.3-0ubuntu1vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.1vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.2vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.3vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.4vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.5vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.6vulnerable
Ubuntugit16.041:2.7.4-0ubuntu1.7fixed
Ubuntugit18.041:2.14.1-1ubuntu4vulnerable
Ubuntugit18.041:2.15.1-1ubuntu2vulnerable
Ubuntugit18.041:2.17.0-1ubuntu1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.1vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.3vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.4vulnerable
Ubuntugit18.041:2.17.1-1ubuntu0.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangitsourcesid1:2.24.0-2not yet assignedNot reportedNot reported
Debiangitsourceforky1:2.24.0-2not yet assignedNot reportedNot reported
Debiangitsourcetrixie1:2.24.0-2not yet assignedNot reportedNot reported
Debiangitsourcebookworm1:2.24.0-2not yet assignedNot reportedNot reported
Alpinegitapk3.102.22.2-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.112.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.122.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.132.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.142.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.152.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.162.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.172.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.182.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.192.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.202.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.212.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.222.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.232.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.242.24.1-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.72.15.4-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.82.18.2-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinegitapk3.92.20.2-r0Not reportedALPINE-CVE-2019-1352Not reported
Alpinelibgit2apk3.110.28.4-r0Not reportedALPINE-CVE-2019-1352Not reported
Suselibgit2rpmlinux enterprise high performance computing 15-espos0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise high performance computing 15-ltss0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise high performance computing 15 sp1-espos0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise high performance computing 15 sp1-ltss0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise high performance computing 15 sp2-espos0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise high performance computing 15 sp2-ltss0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server 15-ltss0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server 15 sp1-bcl0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server 15 sp1-ltss0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server 15 sp2-bcl0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server 15 sp2-ltss0.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server for sap applications 150.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server for sap applications 15 sp10.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmlinux enterprise server for sap applications 15 sp20.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmmanager proxy 4.10.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmmanager retail branch server 4.10.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmmanager server 4.10.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmenterprise storage 60.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Suselibgit2rpmenterprise storage 70.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Opensuselibgit2rpmleap 15.30.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Opensuselibgit2rpmleap 15.40.26.8-150000.3.15.1Not reportedSUSE-SU-2022:3495-1Not reported
Ubuntugitdeb16.041:2.7.4-0ubuntu1.7Not reportedUBUNTU-CVE-2019-1352Not reported
Ubuntugitdeb18.041:2.17.1-1ubuntu0.5Not reportedUBUNTU-CVE-2019-1352Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [git]Unknown
    Details (4)
    • 1:2.39.5-0+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-all]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-cvs]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-doc]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-email]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-gui]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [gitk]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-man]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-mediawiki]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [git-svn]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

  • [gitweb]Unknown

    Source package: [git]

    Details (4)
    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u3 · all · bookworm

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

    • 1:2.39.5-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · bookworm; dsa · git · debian · 12

[Debian 13 (Trixie)]

  • [git]Unknown
    Details (2)
    • 1:2.47.3-0+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

  • [git-all]Unknown

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

  • [git-cvs]Unknown

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

  • [git-doc]Unknown

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

  • [git-email]Unknown

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

  • [git-gui]Unknown

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

  • [gitk]Unknown

    Source package: [git]

    Details (2)
    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

    • 1:2.47.3-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:2.24.0-2

      dsa · git · debian · 13

Next results

Observed:

References