CVE-2014-9390
published 2020-02-12CVE-2014-9390: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows…
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | <= 6.1.1 | — |
| apple | xcode | — | — |
| apple | xcode | — | — |
| debian | dulwich | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | git | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | jgit | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | libgit2 | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | mercurial | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| eclipse | egit | < 08-12-2014 | 08-12-2014 |
| eclipse | jgit | < 3.4.2 | 3.4.2 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 3.5.0 < 3.5.3 | 3.5.3 |
| git-scm | git | < 1.8.5.6 | 1.8.5.6 |
| git-scm | git | >= 1.9.0 < 1.9.5 | 1.9.5 |
| git-scm | git | >= 2.0.0 < 2.0.5 | 2.0.5 |
| git-scm | git | >= 2.1.0 < 2.1.4 | 2.1.4 |
| git-scm | git | >= 2.2.0 < 2.2.1 | 2.2.1 |
| git | git | >= 0 < 1:2.1.4-1 | 1:2.1.4-1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL