CVE ID:	CVE-2019-19604
Description:	Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
Test IDs:	1.3.6.1.4.1.25623.1.0.704581
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-19604 Debian Security Information: DSA-4581 (Google Search) https://www.debian.org/security/2019/dsa-4581 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/ https://security.gentoo.org/glsa/202003-30 https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.md http://www.openwall.com/lists/oss-security/2019/12/13/1 SuSE Security Announcement: openSUSE-SU-2020:0123 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html SuSE Security Announcement: openSUSE-SU-2020:0598 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html