GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result
    in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via
    The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).
    (CVE-2018-1000021)

An update of the git package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result     in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via     The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).
    (CVE-2018-1000021)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GIT version 2.15.1 and earlier contains a Input     Validation Error vulnerability in Client that can     result in problems including messing up terminal     configuration to RCE. This attack appear to be     exploitable via The user must interact with a malicious     git server, (or have their traffic modified in a MITM     attack).(CVE-2018-1000021)

  - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before     2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2     uses unsafe Perl scripts to support subcommands such as     cvsserver, which allows attackers to execute arbitrary     OS commands via shell metacharacters in a module name.
    The vulnerable code is reachable via git-shell even     without CVS support.(CVE-2017-14867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
457250	Echo: git: security update to 1:2.39.5-0+deb12u2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457250	Echo: git: security update to 1:2.39.5-0+deb12u2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
333673	Photon OS 5.0: Git PHSA-2025-5.0-91-0590	Nessus	PhotonOS Local Security Checks	Local	low
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	Local	critical
221651	Linux Distros Unpatched Vulnerability : CVE-2018-1000021	Nessus	Misc.	Local	medium
130862	EulerOS 2.0 SP5 : git (EulerOS-SA-2019-2153)	Nessus	Huawei Local Security Checks	Local	high

Detections

Analytics

CVE-2018-1000021

medium

Tenable Plugins

medium

medium

low

critical

medium

high