CVE-2013-0308
Fixed in a distro release EPSS 2%
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Products: git-scm git
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 | emacs-git | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | emacs-git-el | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-all | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-cvs | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-daemon | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-debuginfo | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-email | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-gui | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | git-svn | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | gitk | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | gitweb | 0:1.7.1-3.el6_4.1 |
| Red Hat Enterprise Linux 6 | perl-Git | 0:1.7.1-3.el6_4.1 |