CPANSA-Git-XS-2014-9390-libgit2: Git-XS vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2020-02-12T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2020-02-12T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 9.8 | Severity | Critical |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Vulnerabilities
CVE-2014-9390
Vulnerability DescriptionGit before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
| Weakness | CWE-20 : Improper Input Validation |
|---|
Product status
Known affected
| Product | Score | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Git-XS greater than or equal 0.01 and less than or equal 0.02 |
|
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Git-XS-2014-9390-libgit2 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2020/cpansa-git-xs-2014-9390-libgit2.json - https://news.ycombinator.com/item?id=8769667 external
https://news.ycombinator.com/item?id=8769667 - http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html external
http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html - https://github.com/blog/1938-git-client-vulnerability-announced external
https://github.com/blog/1938-git-client-vulnerability-announced - http://securitytracker.com/id?1031404 external
http://securitytracker.com/id?1031404 - http://article.gmane.org/gmane.linux.kernel/1853266 external
http://article.gmane.org/gmane.linux.kernel/1853266 - http://mercurial.selenic.com/wiki/WhatsNew external
http://mercurial.selenic.com/wiki/WhatsNew - http://support.apple.com/kb/HT204147 external
http://support.apple.com/kb/HT204147 - https://libgit2.org/security/ external
https://libgit2.org/security/ - https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 external
https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 - CVE-2014-9390 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2014-9390
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Wed Feb 12 00:00:00 2020 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/