CVE-2014-9390

EUVD-2020-0110

12.02.2020, 02:15

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Affected Products (NVD)

Vendor	Product	Version
git-scm	git	𝑥 < 1.8.5.6
git-scm	git	1.9.0 ≤ 𝑥 < 1.9.5
git-scm	git	2.0.0 ≤ 𝑥 < 2.0.5
git-scm	git	2.1.0 ≤ 𝑥 < 2.1.4
git-scm	git	2.2.0 ≤ 𝑥 < 2.2.1
mercurial	mercurial	𝑥 < 3.2.3
apple	xcode	𝑥 ≤ 6.1.1
apple	xcode	6.2
apple	xcode	6.2:beta_2
eclipse	egit	𝑥 < 08-12-2014
eclipse	jgit	𝑥 < 3.4.2
eclipse	jgit	3.5.0 ≤ 𝑥 < 3.5.3
libgit2	libgit2	𝑥 < 0.21.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

dulwich

bookworm	0.21.2-1 fixed
bullseye	0.20.15-1 fixed
jessie	no-dsa
sid	0.21.6-1 fixed
squeeze	no-dsa
trixie	0.21.6-1 fixed
wheezy	no-dsa

git

bookworm	1:2.39.2-1.1 fixed
bookworm (security)	1:2.39.5-0+deb12u1 fixed
bullseye	1:2.30.2-1+deb11u2 fixed
bullseye (security)	1:2.30.2-1+deb11u3 fixed
jessie	no-dsa
sid	1:2.45.2-1.1 fixed
squeeze	no-dsa
trixie	1:2.45.2-1 fixed
wheezy	no-dsa

jgit

bookworm	4.11.9-2 fixed
bullseye	4.11.9-1 fixed
jessie	no-dsa
sid	6.7.0-2 fixed
squeeze	no-dsa
trixie	6.7.0-2 fixed
wheezy	no-dsa

libgit2

bookworm	1.5.1+ds-1+deb12u1 fixed
bookworm (security)	1.5.1+ds-1+deb12u1 fixed
bullseye	1.1.0+dfsg.1-4+deb11u2 fixed
bullseye (security)	1.1.0+dfsg.1-4+deb11u2 fixed
jessie	no-dsa
sid	1.8.4+ds-1 fixed
squeeze	no-dsa
trixie	1.8.2~rc1+ds2-1 fixed
wheezy	no-dsa

mercurial

bookworm	6.3.2-1 fixed
bullseye	5.6.1-4 fixed
jessie	no-dsa
sid	6.8.2-1 fixed
squeeze	no-dsa
trixie	6.8.2-1 fixed
wheezy	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

git

artful	Fixed 1:2.1.4-2 released
bionic	Fixed 1:2.1.4-2 released
cosmic	Fixed 1:2.1.4-2 released
disco	Fixed 1:2.1.4-2 released
eoan	Fixed 1:2.1.4-2 released
focal	Fixed 1:2.1.4-2 released
groovy	Fixed 1:2.1.4-2 released
hirsute	Fixed 1:2.1.4-2 released
impish	Fixed 1:2.1.4-2 released
jammy	Fixed 1:2.1.4-2 released
kinetic	Fixed 1:2.1.4-2 released
lucid	dne
lunar	Fixed 1:2.1.4-2 released
mantic	Fixed 1:2.1.4-2 released
noble	Fixed 1:2.1.4-2 released
precise	Fixed 1:1.7.9.5-1ubuntu0.1 released
trusty	Fixed 1:1.9.1-1ubuntu0.1 released
utopic	Fixed 1:2.1.0-1ubuntu0.1 released
vivid	Fixed 1:2.1.4-2 released
wily	Fixed 1:2.1.4-2 released
xenial	Fixed 1:2.1.4-2 released
yakkety	Fixed 1:2.1.4-2 released
zesty	Fixed 1:2.1.4-2 released

git-core

artful	dne
bionic	dne
cosmic	dne
disco	dne
eoan	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lucid	ignored
lunar	dne
mantic	dne
noble	dne
precise	dne
trusty	dne
utopic	dne
vivid	dne
wily	dne
xenial	dne
yakkety	dne
zesty	dne

jgit

artful	ignored
bionic	not-affected
cosmic	not-affected
disco	not-affected
eoan	not-affected
focal	not-affected
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lucid	dne
lunar	not-affected
mantic	not-affected
noble	not-affected
precise	dne
trusty	dne
utopic	ignored
vivid	ignored
wily	ignored
xenial	not-affected
yakkety	ignored
zesty	ignored

libgit2

artful	ignored
bionic	not-affected
cosmic	not-affected
disco	not-affected
eoan	not-affected
focal	not-affected
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lucid	dne
lunar	not-affected
mantic	not-affected
noble	not-affected
precise	dne
trusty	needed
utopic	ignored
vivid	ignored
wily	ignored
xenial	not-affected
yakkety	ignored
zesty	ignored

mercurial

artful	not-affected
bionic	not-affected
cosmic	not-affected
disco	not-affected
eoan	not-affected
focal	not-affected
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lucid	ignored
lunar	not-affected
mantic	not-affected
noble	not-affected
precise	Fixed 2.0.2-1ubuntu1.2 released
trusty	Fixed 2.8.2-1ubuntu1.3 released
utopic	Fixed 3.1.1-1ubuntu0.2 released
vivid	not-affected
wily	not-affected
xenial	not-affected
yakkety	not-affected
zesty	not-affected