PT-2017-6411 · Git+4 · Git+4

Publicado 2014-09-29 · Atualizado 2020-04-29 · CVE-2014-9938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Git versions prior to 1.9.3

Description The issue allows a malicious repository to cause code execution due to unsanitized branch names in the PS1 variable.

Recommendations For versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue.

Exploit

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

ALT-PU-2014-2208

CESA-2017_2004

CVE-2014-9938

RHSA-2017:2004

RHSA-2017_2004

USN-3243-1

Produtos afetados

Alt Linux

Centos

Git

Red Hat

Ubuntu

Referências · 13

• 🔥 https://github.com/njhartwell/pw3nage · Exploit
• https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f · Correção
• https://security-tracker.debian.org/tracker/CVE-2014-9938 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9938 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2017-2004.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2004 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3243-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9938 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9938 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-9938 · Nota de Segurança
• https://osv.dev/vulnerability/USN-3243-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-9938 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9938 · Nota de Segurança