Untrusted Search Path

Affecting git package, versions <2.18.1-r1

Overview

Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.

References

• CVE Details
• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• MISC
• RHSA Security Advisory
• Security Focus
• Security Tracker
• Ubuntu CVE Tracker
• Ubuntu Security Advisory