PT-2014-8981 · Git+7 · Git+8
Augie Fackler
+1
·
Published
2014-12-19
·
Updated
2024-06-15
·
CVE-2014-9390
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Git versions 1.8.5.6 and earlier, 1.9.x through 1.9.4, 2.0.x through 2.0.4, 2.1.x through 2.1.3, and 2.2.x through 2.2.0
Mercurial versions prior to 3.2.3
Apple Xcode versions prior to 6.2 beta 3
mine versions prior to 08-12-2014
libgit2 versions up to 0.21.2
Egit versions prior to 08-12-2014
JGit versions prior to 08-12-2014
Description
The issue allows remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Recommendations
For Git versions 1.8.5.6 and earlier, 1.9.x through 1.9.4, 2.0.x through 2.0.4, 2.1.x through 2.1.3, and 2.2.x through 2.2.0, update to a version later than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4, or 2.2.1 respectively.
For Mercurial versions prior to 3.2.3, update to version 3.2.3 or later.
For Apple Xcode versions prior to 6.2 beta 3, update to version 6.2 beta 3 or later.
For mine versions prior to 08-12-2014, update to a version released after 08-12-2014.
For libgit2 versions up to 0.21.2, update to a version later than 0.21.2.
For Egit versions prior to 08-12-2014, update to a version released after 08-12-2014.
For JGit versions prior to 08-12-2014, update to a version released after 08-12-2014.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Xcode
Egit
Git
Jgit
Mercurial
Suse
Ubuntu
Libgit2