CVE-2018-19486 in Git
Summary
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Reservation
11/23/2018
Disclosure
11/23/2018
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 127082 | Git run-command.c run_command untrusted search path | 426 | Not defined | Official fix | CVE-2018-19486 |