crítica
CVE-2014-9390
git: arbitrary command execution vulnerability on case-insensitive file systems
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:P/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Photon OS. Más baja según Ubuntu (media), Red Hat (baja).
Descripción
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git, git-extras, git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich, git, jgit y 2 más | 0.10.1-1 y 4 más |
| debian 12 | dulwich, git, jgit y 2 más | 0.10.1-1 y 4 más |
| debian 13 | dulwich, git, jgit y 2 más | 0.10.1-1 y 4 más |
| debian 14 | dulwich, git, jgit y 2 más | 0.10.1-1 y 4 más |
| debian 7 | dulwich, git, jgit y 1 más | 2.2.2-4 |
| debian 8 | dulwich, jgit, libgit2 | 0.21.1-3 |
| echo | dulwich, git, jgit y 2 más | 0.10.1-1 y 4 más |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
Mostrar las 76 entradas de 46 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-extras | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich | 0.10.1-1 |
| debian 11 | git | 1:2.1.4-1 |
| debian 11 | jgit | 3.7.0-1 |
| debian 11 | libgit2 | 0.21.3-1 |
| debian 11 | mercurial | 3.1.2-2 |
| debian 12 | dulwich | 0.10.1-1 |
| debian 12 | git | 1:2.1.4-1 |
| debian 12 | jgit | 3.7.0-1 |
| debian 12 | libgit2 | 0.21.3-1 |
| debian 12 | mercurial | 3.1.2-2 |
| debian 13 | dulwich | 0.10.1-1 |
| debian 13 | git | 1:2.1.4-1 |
| debian 13 | jgit | 3.7.0-1 |
| debian 13 | libgit2 | 0.21.3-1 |
| debian 13 | mercurial | 3.1.2-2 |
| debian 14 | dulwich | 0.10.1-1 |
| debian 14 | git | 1:2.1.4-1 |
| debian 14 | jgit | 3.7.0-1 |
| debian 14 | libgit2 | 0.21.3-1 |
| debian 14 | mercurial | 3.1.2-2 |
| debian 7 | dulwich | sin corrección indicada |
| debian 7 | git | sin corrección indicada |
| debian 7 | jgit | sin corrección indicada |
| debian 7 | mercurial | 2.2.2-4 |
| debian 8 | dulwich | sin corrección indicada |
| debian 8 | jgit | sin corrección indicada |
| debian 8 | libgit2 | 0.21.1-3 |
| echo | dulwich | 0.10.1-1 |
| echo | git | 1:2.1.4-1 |
| echo | jgit | 3.7.0-1 |
| echo | libgit2 | 0.21.3-1 |
| echo | mercurial | 3.1.2-2 |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
| root.io debian 13 | rootio-git | 1:2.1.4-1 |
| root.io ubuntu 22.04 | rootio-git | 1:2.1.4-2 |
| root.io ubuntu 24.04 | rootio-git | 1:2.1.4-2 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.1 |
| ubuntu 12.04 | mercurial | 2.0.2-1ubuntu1.2 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.1 |
| ubuntu 14.04 | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.04-ESM | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.10 | git | 1:2.1.0-1ubuntu0.1 |
| ubuntu 14.10 | mercurial | 3.1.1-1ubuntu0.2 |
| ubuntu 15.04 | git | 1:2.1.4-2 |
| ubuntu 15.10 | git | 1:2.1.4-2 |
| ubuntu 16.04 | git | 1:2.1.4-2 |
| ubuntu 16.04-ESM | git | 1:2.1.4-2 |
| ubuntu 16.10 | git | 1:2.1.4-2 |
| ubuntu 17.04 | git | 1:2.1.4-2 |
| ubuntu 17.10 | git | 1:2.1.4-2 |
| ubuntu 18.04 | git | 1:2.1.4-2 |
| ubuntu 18.04-ESM | git | 1:2.1.4-2 |
| ubuntu 18.10 | git | 1:2.1.4-2 |
| ubuntu 19.04 | git | 1:2.1.4-2 |
| ubuntu 19.10 | git | 1:2.1.4-2 |
| ubuntu 20.04 | git | 1:2.1.4-2 |
| ubuntu 20.04-ESM | git | 1:2.1.4-2 |
| ubuntu 20.10 | git | 1:2.1.4-2 |
| ubuntu 21.04 | git | 1:2.1.4-2 |
| ubuntu 21.10 | git | 1:2.1.4-2 |
| ubuntu 22.04 | git | 1:2.1.4-2 |
| ubuntu 22.10 | git | 1:2.1.4-2 |
| ubuntu 23.04 | git | 1:2.1.4-2 |
| ubuntu 23.10 | git | 1:2.1.4-2 |
| ubuntu 24.04 | git | 1:2.1.4-2 |
| ubuntu 24.10 | git | 1:2.1.4-2 |
| ubuntu 25.04 | git | 1:2.1.4-2 |
| ubuntu 25.10 | git | 1:2.1.4-2 |
| ubuntu 26.04 | git | 1:2.1.4-2 |
| ubuntu 26.10 | git | 1:2.1.4-2 |
Referencias
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://access.redhat.com/security/cve/CVE-2014-9390
Las 20 referencias
- https://developer.atlassian.com/blog/2014/12/securing-your-git-server/
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2020-217.yaml
- https://libgit2.org/security
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
- https://nvd.nist.gov/vuln/detail/CVE-2014-9390
- https://projects.eclipse.org/projects/technology.jgit/releases/3.5.3
- https://ubuntu.com/security/notices/USN-2470-1
- https://web.archive.org/web/20211204220400/https://securitytracker.com/id?1031404
- https://www.cve.org/CVERecord?id=CVE-2014-9390