CVE-2014-9390
12.02.2020, 02:15
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.Enginsight
| Vendor | Product | Version |
|---|---|---|
| git-scm | git | 𝑥 < 1.8.5.6 |
| git-scm | git | 1.9.0 ≤ 𝑥 < 1.9.5 |
| git-scm | git | 2.0.0 ≤ 𝑥 < 2.0.5 |
| git-scm | git | 2.1.0 ≤ 𝑥 < 2.1.4 |
| git-scm | git | 2.2.0 ≤ 𝑥 < 2.2.1 |
| mercurial | mercurial | 𝑥 < 3.2.3 |
| apple | xcode | 𝑥 ≤ 6.1.1 |
| apple | xcode | 6.2 |
| apple | xcode | 6.2:beta_2 |
| eclipse | egit | 𝑥 < 08-12-2014 |
| eclipse | jgit | 𝑥 < 3.4.2 |
| eclipse | jgit | 3.5.0 ≤ 𝑥 < 3.5.3 |
| libgit2 | libgit2 | 𝑥 < 0.21.3 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| dulwich |
| ||||||||||||||||||
| git |
| ||||||||||||||||||
| jgit |
| ||||||||||||||||||
| libgit2 |
| ||||||||||||||||||
| mercurial |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| git |
| ||||||||||||||||||||||||||||||||||||||||||||||
| git-core |
| ||||||||||||||||||||||||||||||||||||||||||||||
| jgit |
| ||||||||||||||||||||||||||||||||||||||||||||||
| libgit2 |
| ||||||||||||||||||||||||||||||||||||||||||||||
| mercurial |
|
Common Weakness Enumeration
References