critique
CVE-2014-9390
git: arbitrary command execution vulnerability on case-insensitive file systems
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:P/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Ubuntu (moyenne), Red Hat (faible).
Description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git, git-extras, git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich, git, jgit et 2 autres | 0.10.1-1 et 4 autres |
| debian 12 | dulwich, git, jgit et 2 autres | 0.10.1-1 et 4 autres |
| debian 13 | dulwich, git, jgit et 2 autres | 0.10.1-1 et 4 autres |
| debian 14 | dulwich, git, jgit et 2 autres | 0.10.1-1 et 4 autres |
| debian 7 | dulwich, git, jgit et 1 autres | 2.2.2-4 |
| debian 8 | dulwich, jgit, libgit2 | 0.21.1-3 |
| echo | dulwich, git, jgit et 2 autres | 0.10.1-1 et 4 autres |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
Afficher les 76 entrées de 46 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-extras | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich | 0.10.1-1 |
| debian 11 | git | 1:2.1.4-1 |
| debian 11 | jgit | 3.7.0-1 |
| debian 11 | libgit2 | 0.21.3-1 |
| debian 11 | mercurial | 3.1.2-2 |
| debian 12 | dulwich | 0.10.1-1 |
| debian 12 | git | 1:2.1.4-1 |
| debian 12 | jgit | 3.7.0-1 |
| debian 12 | libgit2 | 0.21.3-1 |
| debian 12 | mercurial | 3.1.2-2 |
| debian 13 | dulwich | 0.10.1-1 |
| debian 13 | git | 1:2.1.4-1 |
| debian 13 | jgit | 3.7.0-1 |
| debian 13 | libgit2 | 0.21.3-1 |
| debian 13 | mercurial | 3.1.2-2 |
| debian 14 | dulwich | 0.10.1-1 |
| debian 14 | git | 1:2.1.4-1 |
| debian 14 | jgit | 3.7.0-1 |
| debian 14 | libgit2 | 0.21.3-1 |
| debian 14 | mercurial | 3.1.2-2 |
| debian 7 | dulwich | pas de correctif indiqué |
| debian 7 | git | pas de correctif indiqué |
| debian 7 | jgit | pas de correctif indiqué |
| debian 7 | mercurial | 2.2.2-4 |
| debian 8 | dulwich | pas de correctif indiqué |
| debian 8 | jgit | pas de correctif indiqué |
| debian 8 | libgit2 | 0.21.1-3 |
| echo | dulwich | 0.10.1-1 |
| echo | git | 1:2.1.4-1 |
| echo | jgit | 3.7.0-1 |
| echo | libgit2 | 0.21.3-1 |
| echo | mercurial | 3.1.2-2 |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
| root.io debian 13 | rootio-git | 1:2.1.4-1 |
| root.io ubuntu 22.04 | rootio-git | 1:2.1.4-2 |
| root.io ubuntu 24.04 | rootio-git | 1:2.1.4-2 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.1 |
| ubuntu 12.04 | mercurial | 2.0.2-1ubuntu1.2 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.1 |
| ubuntu 14.04 | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.04-ESM | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.10 | git | 1:2.1.0-1ubuntu0.1 |
| ubuntu 14.10 | mercurial | 3.1.1-1ubuntu0.2 |
| ubuntu 15.04 | git | 1:2.1.4-2 |
| ubuntu 15.10 | git | 1:2.1.4-2 |
| ubuntu 16.04 | git | 1:2.1.4-2 |
| ubuntu 16.04-ESM | git | 1:2.1.4-2 |
| ubuntu 16.10 | git | 1:2.1.4-2 |
| ubuntu 17.04 | git | 1:2.1.4-2 |
| ubuntu 17.10 | git | 1:2.1.4-2 |
| ubuntu 18.04 | git | 1:2.1.4-2 |
| ubuntu 18.04-ESM | git | 1:2.1.4-2 |
| ubuntu 18.10 | git | 1:2.1.4-2 |
| ubuntu 19.04 | git | 1:2.1.4-2 |
| ubuntu 19.10 | git | 1:2.1.4-2 |
| ubuntu 20.04 | git | 1:2.1.4-2 |
| ubuntu 20.04-ESM | git | 1:2.1.4-2 |
| ubuntu 20.10 | git | 1:2.1.4-2 |
| ubuntu 21.04 | git | 1:2.1.4-2 |
| ubuntu 21.10 | git | 1:2.1.4-2 |
| ubuntu 22.04 | git | 1:2.1.4-2 |
| ubuntu 22.10 | git | 1:2.1.4-2 |
| ubuntu 23.04 | git | 1:2.1.4-2 |
| ubuntu 23.10 | git | 1:2.1.4-2 |
| ubuntu 24.04 | git | 1:2.1.4-2 |
| ubuntu 24.10 | git | 1:2.1.4-2 |
| ubuntu 25.04 | git | 1:2.1.4-2 |
| ubuntu 25.10 | git | 1:2.1.4-2 |
| ubuntu 26.04 | git | 1:2.1.4-2 |
| ubuntu 26.10 | git | 1:2.1.4-2 |
Références
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://access.redhat.com/security/cve/CVE-2014-9390
Les 20 références
- https://developer.atlassian.com/blog/2014/12/securing-your-git-server/
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2020-217.yaml
- https://libgit2.org/security
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
- https://nvd.nist.gov/vuln/detail/CVE-2014-9390
- https://projects.eclipse.org/projects/technology.jgit/releases/3.5.3
- https://ubuntu.com/security/notices/USN-2470-1
- https://web.archive.org/web/20211204220400/https://securitytracker.com/id?1031404
- https://www.cve.org/CVERecord?id=CVE-2014-9390