FKIE_CVE-2014-9390

Vulnerability from fkie_nvd - Published: 2020-02-12 02:15 - Updated: 2026-06-17 00:18
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
References
cve@mitre.orghttp://article.gmane.org/gmane.linux.kernel/1853266Broken Link
cve@mitre.orghttp://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.htmlThird Party Advisory
cve@mitre.orghttp://mercurial.selenic.com/wiki/WhatsNewRelease Notes, Third Party Advisory
cve@mitre.orghttp://securitytracker.com/id?1031404Third Party Advisory, VDB Entry
cve@mitre.orghttp://support.apple.com/kb/HT204147Vendor Advisory
cve@mitre.orghttps://github.com/blog/1938-git-client-vulnerability-announcedVendor Advisory
cve@mitre.orghttps://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915Third Party Advisory
cve@mitre.orghttps://libgit2.org/security/Product
cve@mitre.orghttps://news.ycombinator.com/item?id=8769667Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://article.gmane.org/gmane.linux.kernel/1853266Broken Link
af854a3a-2127-422b-91ae-364da2661108http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://mercurial.selenic.com/wiki/WhatsNewRelease Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1031404Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT204147Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/blog/1938-git-client-vulnerability-announcedVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://libgit2.org/security/Product
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=8769667Issue Tracking, Patch, Third Party Advisory
Impacted products
Vendor Product Version
git-scm git *
git-scm git *
git-scm git *
git-scm git *
git-scm git *
apple mac_os_x -
microsoft windows -
mercurial mercurial *
apple mac_os_x -
microsoft windows -
apple xcode *
apple xcode 6.2
apple xcode 6.2
eclipse egit *
eclipse jgit *
eclipse jgit *
libgit2 libgit2 *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDA7AD30-7C02-418F-A62D-9C4C179088DB",
              "versionEndExcluding": "1.8.5.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "639D829A-5F78-49EB-924E-F6495EEB5153",
              "versionEndExcluding": "1.9.5",
              "versionStartIncluding": "1.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9080C10B-548A-45AF-9B62-F80B92EEB4F4",
              "versionEndExcluding": "2.0.5",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "853D6A11-7FA6-4A92-87E2-6F7756E1C96A",
              "versionEndExcluding": "2.1.4",
              "versionStartIncluding": "2.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDEC04F1-09CA-4957-90B6-5D87A68C2C06",
              "versionEndExcluding": "2.2.1",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "99B4890E-102C-442D-AB16-4D859A595656",
              "versionEndExcluding": "3.2.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DDD1870-453C-4B97-BE7B-9B3D6D4856D4",
              "versionEndIncluding": "6.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:xcode:6.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "9D061C24-F869-456D-8D26-8B6F63B6C834",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:xcode:6.2:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "0CD44704-4632-43DC-BC56-F872BCAF3E97",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:egit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB77E9A5-6A32-42BE-81C0-7D87A2076688",
              "versionEndExcluding": "08-12-2014",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5351751-FCFD-429E-8FF4-B8E9954D7248",
              "versionEndExcluding": "3.4.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1B88228-1044-4794-A954-A1CA8954D1BA",
              "versionEndExcluding": "3.5.3",
              "versionStartIncluding": "3.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "973A3E4A-6E15-4137-9933-4609A9CC805C",
              "versionEndExcluding": "0.21.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem."
    },
    {
      "lang": "es",
      "value": "Git versiones anteriores a 1.8.5.6, versiones 1.9.x anteriores a 1.9.5, versiones  2.0.x anteriores a 2.0.5, versiones 2.1.x anteriores a 2.1.4 y versiones 2.2.x anteriores a 2.2.1 en Windows y OS X; Mercurial versiones anteriores a 3.2.3 en Windows y OS X; Apple Xcode versiones anteriores a 6.2 beta 3;  mine todas las versiones antes del 08-12-2014; libgit2 todas las versiones hasta 0.21. 2; Egit todas las versiones anteriores al 08-12-2014; y JGit todas las versiones anteriores al 08-12-2014 permiten a los servidores Git remotos ejecutar comandos arbitrarios por medio de un \u00e1rbol que contiene un archivo .git/config dise\u00f1ado con (1) un punto de c\u00f3digo Unicode ignorable, (2) una representaci\u00f3n git~1/config, o (3) may\u00fasculas y min\u00fasculas que no son manejadas apropiadamente en un sistema de archivos insensible a may\u00fasculas y min\u00fasculas"
    }
  ],
  "id": "CVE-2014-9390",
  "lastModified": "2026-06-17T00:18:16.477",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-02-12T02:15:10.963",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://article.gmane.org/gmane.linux.kernel/1853266"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "http://mercurial.selenic.com/wiki/WhatsNew"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://securitytracker.com/id?1031404"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT204147"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/blog/1938-git-client-vulnerability-announced"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://libgit2.org/security/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://news.ycombinator.com/item?id=8769667"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://article.gmane.org/gmane.linux.kernel/1853266"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "http://mercurial.selenic.com/wiki/WhatsNew"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://securitytracker.com/id?1031404"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT204147"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/blog/1938-git-client-vulnerability-announced"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://libgit2.org/security/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://news.ycombinator.com/item?id=8769667"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.