CVE-2014-9390
Fixed in a distro release EPSS 76%
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Products: git-scm git, mercurial, apple xcode, eclipse egit, eclipse jgit, libgit2
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| PyPI | mercurial | 3.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | dulwich | 0.10.1-1 |
| Debian 12 | git | 1:2.1.4-1 |
| Debian 12 | jgit | 3.7.0-1 |
| Debian 12 | libgit2 | 0.21.3-1 |
| Debian 12 | mercurial | 3.1.2-2 |
| Debian 13 | dulwich | 0.10.1-1 |
| Debian 13 | git | 1:2.1.4-1 |
| Debian 13 | jgit | 3.7.0-1 |
| Debian 13 | libgit2 | 0.21.3-1 |
| Debian 13 | mercurial | 3.1.2-2 |
| Debian 14 | dulwich | 0.10.1-1 |
| Debian 14 | git | 1:2.1.4-1 |
| Debian 14 | jgit | 3.7.0-1 |
| Debian 14 | libgit2 | 0.21.3-1 |
| Debian 14 | mercurial | 3.1.2-2 |
| Debian 6.0 | mercurial | 1.6.4-1+deb6u1 |
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.1 |
| Ubuntu 14.04 LTS | mercurial | 2.8.2-1ubuntu1.3 |
| Ubuntu Pro 14.04 LTS | libgit2 | no fix |
| openSUSE Tumbleweed | git | 2.11.0-1.1 |