kritisch
CVE-2014-9390
git: arbitrary command execution vulnerability on case-insensitive file systems
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:P/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Photon OS. Niedriger laut Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git, git-extras, git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich, git, jgit und 2 weitere | 0.10.1-1 und 4 weitere |
| debian 12 | dulwich, git, jgit und 2 weitere | 0.10.1-1 und 4 weitere |
| debian 13 | dulwich, git, jgit und 2 weitere | 0.10.1-1 und 4 weitere |
| debian 14 | dulwich, git, jgit und 2 weitere | 0.10.1-1 und 4 weitere |
| debian 7 | dulwich, git, jgit und 1 weitere | 2.2.2-4 |
| debian 8 | dulwich, jgit, libgit2 | 0.21.1-3 |
| echo | dulwich, git, jgit und 2 weitere | 0.10.1-1 und 4 weitere |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
Alle 76 Einträge aus 46 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-extras | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich | 0.10.1-1 |
| debian 11 | git | 1:2.1.4-1 |
| debian 11 | jgit | 3.7.0-1 |
| debian 11 | libgit2 | 0.21.3-1 |
| debian 11 | mercurial | 3.1.2-2 |
| debian 12 | dulwich | 0.10.1-1 |
| debian 12 | git | 1:2.1.4-1 |
| debian 12 | jgit | 3.7.0-1 |
| debian 12 | libgit2 | 0.21.3-1 |
| debian 12 | mercurial | 3.1.2-2 |
| debian 13 | dulwich | 0.10.1-1 |
| debian 13 | git | 1:2.1.4-1 |
| debian 13 | jgit | 3.7.0-1 |
| debian 13 | libgit2 | 0.21.3-1 |
| debian 13 | mercurial | 3.1.2-2 |
| debian 14 | dulwich | 0.10.1-1 |
| debian 14 | git | 1:2.1.4-1 |
| debian 14 | jgit | 3.7.0-1 |
| debian 14 | libgit2 | 0.21.3-1 |
| debian 14 | mercurial | 3.1.2-2 |
| debian 7 | dulwich | kein Fix angegeben |
| debian 7 | git | kein Fix angegeben |
| debian 7 | jgit | kein Fix angegeben |
| debian 7 | mercurial | 2.2.2-4 |
| debian 8 | dulwich | kein Fix angegeben |
| debian 8 | jgit | kein Fix angegeben |
| debian 8 | libgit2 | 0.21.1-3 |
| echo | dulwich | 0.10.1-1 |
| echo | git | 1:2.1.4-1 |
| echo | jgit | 3.7.0-1 |
| echo | libgit2 | 0.21.3-1 |
| echo | mercurial | 3.1.2-2 |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
| root.io debian 13 | rootio-git | 1:2.1.4-1 |
| root.io ubuntu 22.04 | rootio-git | 1:2.1.4-2 |
| root.io ubuntu 24.04 | rootio-git | 1:2.1.4-2 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.1 |
| ubuntu 12.04 | mercurial | 2.0.2-1ubuntu1.2 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.1 |
| ubuntu 14.04 | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.04-ESM | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.10 | git | 1:2.1.0-1ubuntu0.1 |
| ubuntu 14.10 | mercurial | 3.1.1-1ubuntu0.2 |
| ubuntu 15.04 | git | 1:2.1.4-2 |
| ubuntu 15.10 | git | 1:2.1.4-2 |
| ubuntu 16.04 | git | 1:2.1.4-2 |
| ubuntu 16.04-ESM | git | 1:2.1.4-2 |
| ubuntu 16.10 | git | 1:2.1.4-2 |
| ubuntu 17.04 | git | 1:2.1.4-2 |
| ubuntu 17.10 | git | 1:2.1.4-2 |
| ubuntu 18.04 | git | 1:2.1.4-2 |
| ubuntu 18.04-ESM | git | 1:2.1.4-2 |
| ubuntu 18.10 | git | 1:2.1.4-2 |
| ubuntu 19.04 | git | 1:2.1.4-2 |
| ubuntu 19.10 | git | 1:2.1.4-2 |
| ubuntu 20.04 | git | 1:2.1.4-2 |
| ubuntu 20.04-ESM | git | 1:2.1.4-2 |
| ubuntu 20.10 | git | 1:2.1.4-2 |
| ubuntu 21.04 | git | 1:2.1.4-2 |
| ubuntu 21.10 | git | 1:2.1.4-2 |
| ubuntu 22.04 | git | 1:2.1.4-2 |
| ubuntu 22.10 | git | 1:2.1.4-2 |
| ubuntu 23.04 | git | 1:2.1.4-2 |
| ubuntu 23.10 | git | 1:2.1.4-2 |
| ubuntu 24.04 | git | 1:2.1.4-2 |
| ubuntu 24.10 | git | 1:2.1.4-2 |
| ubuntu 25.04 | git | 1:2.1.4-2 |
| ubuntu 25.10 | git | 1:2.1.4-2 |
| ubuntu 26.04 | git | 1:2.1.4-2 |
| ubuntu 26.10 | git | 1:2.1.4-2 |
Referenzen
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://access.redhat.com/security/cve/CVE-2014-9390
Alle 20 Referenzen
- https://developer.atlassian.com/blog/2014/12/securing-your-git-server/
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2020-217.yaml
- https://libgit2.org/security
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
- https://nvd.nist.gov/vuln/detail/CVE-2014-9390
- https://projects.eclipse.org/projects/technology.jgit/releases/3.5.3
- https://ubuntu.com/security/notices/USN-2470-1
- https://web.archive.org/web/20211204220400/https://securitytracker.com/id?1031404
- https://www.cve.org/CVERecord?id=CVE-2014-9390