CVE-2014-9390

Description

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

How to fix CVE-2014-9390

To remediate CVE-2014-9390, upgrade the affected package to a fixed version below.

• —upgrade to 0.10.1-1 or later
• —upgrade to 1:2.1.4-1 or later
• —upgrade to 3.7.0-1 or later
• —upgrade to 0.21.3-1 or later
• —upgrade to 1.6.4-1+deb6u1 or later
• —upgrade to 3.1.2-2 or later
• —upgrade to 3.5.3 or later
• —upgrade to 3.2.3 or later
• —upgrade to 3.2.3 or later

Is CVE-2014-9390 being exploited?

Likely — EPSS is 77.2%, placing CVE-2014-9390 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (9)

• from 0, < 0.10.1-1
• from 0, < 1:2.1.4-1
• from 0, < 3.7.0-1
• from 0, < 0.21.3-1
• from 0, < 1.6.4-1+deb6u1
• from 0, < 3.1.2-2
• from 0, < 3.5.3
• from 0, < 3.2.3
• from 0, < 3.2.3

CVSS scores

References (16)

• ADVISORYgithub.com/advisories/GHSA-6vvc-c2m3-cjf3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-9390
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-9390
• WEBarticle.gmane.org/gmane.linux.kernel/1853266
• WEB