PT-2017-6411 · Git+4 · Git+4

Published 2014-09-29 · Updated 2020-04-29 · CVE-2014-9938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Git versions prior to 1.9.3

Description The issue allows a malicious repository to cause code execution due to unsanitized branch names in the PS1 variable.

Recommendations For versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

ALT-PU-2014-2208

CESA-2017_2004

CVE-2014-9938

RHSA-2017:2004

RHSA-2017_2004

USN-3243-1

Affected Products

Alt Linux

Centos

Git

Red Hat

Ubuntu

References · 13

• 🔥 https://github.com/njhartwell/pw3nage · Exploit
• https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f · Patch
• https://security-tracker.debian.org/tracker/CVE-2014-9938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9938 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-2004.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2004 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3243-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9938 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9938 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9938 · Security Note
• https://osv.dev/vulnerability/USN-3243-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9938 · Security Note