Linux · Security advisory · December 19, 2019

ELSA-2019-4356: Security update for 14 packages

ELSA-2019-4356, released December 19, 2019, fixes 4 CVEs across 14 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
4
3 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.3401
98th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 3 High 0 Routine 1

Fixed package versions

ProductReleaseFixed in
gitol 80:2.18.2-1.el8_1
git-allol 80:2.18.2-1.el8_1
git-coreol 80:2.18.2-1.el8_1
git-core-docol 80:2.18.2-1.el8_1
git-daemonol 80:2.18.2-1.el8_1
git-emailol 80:2.18.2-1.el8_1
git-guiol 80:2.18.2-1.el8_1
git-instawebol 80:2.18.2-1.el8_1
git-subtreeol 80:2.18.2-1.el8_1
git-svnol 80:2.18.2-1.el8_1
gitkol 80:2.18.2-1.el8_1
gitwebol 80:2.18.2-1.el8_1
perl-Gitol 80:2.18.2-1.el8_1
perl-Git-SVNol 80:2.18.2-1.el8_1

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2019-1349 Git for Visual Studio Remote Code Execution Vulnerability 8.8 0.3401 Exploitation Less Likely
Urgent CVE-2019-1352 Git for Visual Studio Remote Code Execution Vulnerability 8.8 0.2401 Exploitation Less Likely
Urgent CVE-2019-1387 Git for Visual Studio Remote Code Execution Vulnerability 8.8 0.0443 Exploitation Less Likely
Routine CVE-2019-1348 git: Git is a distributed revision control system with a decentralized architecture 3.3 0.0043 None reported
Showing 1 to 4 of 4 1