p PatchFirst

CVE-2014-9390

CVE-2014-9390

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

CVSS 9.8 · Critical · EPSS 75.6% · Public exploit · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • dulwich Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.10.1-1

    Update to 0.10.1-1

  • dulwich Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.10.1-1

    Update to 0.10.1-1

  • dulwich Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.10.1-1

    Update to 0.10.1-1

  • git Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:2.1.4-1

    Update to 1:2.1.4-1

  • git Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:2.1.4-1

    Update to 1:2.1.4-1

  • git Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:2.1.4-1

    Update to 1:2.1.4-1

  • jgit Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.7.0-1

    Update to 3.7.0-1

  • jgit Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.7.0-1

    Update to 3.7.0-1

  • jgit Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.7.0-1

    Update to 3.7.0-1

  • libgit2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.21.3-1

    Update to 0.21.3-1

  • libgit2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.21.3-1

    Update to 0.21.3-1

  • libgit2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.21.3-1

    Update to 0.21.3-1

  • mercurial Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.1.2-2

    Update to 3.1.2-2

  • mercurial Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.2-2

    Update to 3.1.2-2

  • mercurial Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.2-2

    Update to 3.1.2-2

  • org.eclipse.jgit:org.eclipse.jgit Maven

    Versions
    • 1.2.0.201112221803-r
    • 1.3.0.201202151440-r
    • 2.0.0.201206130900-r
    • 2.1.0.201209190230-r
    • 2.2.0.201212191850-r
    • 2.3.1.201302201838-r
    • 3.0.0.201306101825-r
    • 3.1.0.201310021548-r
    • 3.2.0.201312181205-r
    • 3.3.0.201403021825-r
    • 3.3.1.201403241930-r
    • 3.3.2.201404171909-r
    • 3.4.0.201405051725-m7
    • 3.4.0.201405211411-rc1
    • 3.4.0.201405281120-rc2
    • 3.4.0.201406041058-rc3
    • 3.4.0.201406110918-r
    • 3.4.1.201406201815-r
    • 3.4.2.201412180340-r
    • 3.5.0.201409071800-rc1
    • 3.5.0.201409260305-r
    • 3.5.1.201410131835-r
    • 3.5.2.201411120430-r
    Affected ranges
    • ECOSYSTEM: < 3.5.3

    Update to 3.5.3

  • mercurial PyPI

    Versions
    • 0.8.1
    • 0.9
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 0.9.4
    • 0.9.5
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.2
    • 1.2.1
    • 1.3
    • 1.3.1
    • 1.4
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.6
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.7
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.5
    • 1.8
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 1.9
    • 1.9.1
    • 1.9.2
    • 1.9.3
    • 2.0
    • 2.0.1
    • 2.0.2
    • 2.1
    • 2.1.1
    • 2.1.2
    • 2.2
    • 2.2.2
    • 2.3
    • 2.4.1
    • 2.5
    • 2.5.1
    • 2.5.2
    • 2.6
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.8
    • 2.8.1
    • 2.8.2
    • 2.9
    • 2.9.1
    • 3.0
    • 3.0.1
    • 3.1
    • 3.1.1
    • 3.1.2
    • 3.2
    • 3.2.1
    • 3.2.2
    Affected ranges
    • ECOSYSTEM: < 3.2.3

    Update to 3.2.3

  • git Ubuntu:14.04:LTS

    Versions
    • 1:1.8.3.2-1
    • 1:1.8.4.2-1
    • 1:1.8.4.3-1
    • 1:1.8.4.4-1
    • 1:1.8.5-1
    • 1:1.8.5.1-1
    • 1:1.8.5.2-1
    • 1:1.8.5.2-2
    • 1:1.8.5.3-1
    • 1:1.9~rc1-1
    • 1:1.9.0-1
    • 1:1.9.1-1
    Affected ranges
    • ECOSYSTEM: < 1:1.9.1-1ubuntu0.1

    Update to 1:1.9.1-1ubuntu0.1

  • mercurial Ubuntu:14.04:LTS

    Versions
    • 2.6.3-1
    • 2.7.2-1
    • 2.8.1-2
    • 2.8.2-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.8.2-1ubuntu1.3

    Update to 2.8.2-1ubuntu1.3

  • libgit2 Ubuntu:Pro:14.04:LTS

    Versions
    • 0.19.0-2
    • 0.19.0-2ubuntu0.4
    • 0.19.0-2ubuntu0.4+esm1
    • 0.19.0-2ubuntu0.4+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →