kritik
CVE-2014-9390
git: arbitrary command execution vulnerability on case-insensitive file systems
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:P/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Photon OS. Daha düşük diyenler: Ubuntu (orta), Red Hat (düşük).
Açıklama
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git, git-extras, git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich, git, jgit ve 2 tane daha | 0.10.1-1 ve 4 tane daha |
| debian 12 | dulwich, git, jgit ve 2 tane daha | 0.10.1-1 ve 4 tane daha |
| debian 13 | dulwich, git, jgit ve 2 tane daha | 0.10.1-1 ve 4 tane daha |
| debian 14 | dulwich, git, jgit ve 2 tane daha | 0.10.1-1 ve 4 tane daha |
| debian 7 | dulwich, git, jgit ve 1 tane daha | 2.2.2-4 |
| debian 8 | dulwich, jgit, libgit2 | 0.21.1-3 |
| echo | dulwich, git, jgit ve 2 tane daha | 0.10.1-1 ve 4 tane daha |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
46 kaynaktaki 76 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-extras | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich | 0.10.1-1 |
| debian 11 | git | 1:2.1.4-1 |
| debian 11 | jgit | 3.7.0-1 |
| debian 11 | libgit2 | 0.21.3-1 |
| debian 11 | mercurial | 3.1.2-2 |
| debian 12 | dulwich | 0.10.1-1 |
| debian 12 | git | 1:2.1.4-1 |
| debian 12 | jgit | 3.7.0-1 |
| debian 12 | libgit2 | 0.21.3-1 |
| debian 12 | mercurial | 3.1.2-2 |
| debian 13 | dulwich | 0.10.1-1 |
| debian 13 | git | 1:2.1.4-1 |
| debian 13 | jgit | 3.7.0-1 |
| debian 13 | libgit2 | 0.21.3-1 |
| debian 13 | mercurial | 3.1.2-2 |
| debian 14 | dulwich | 0.10.1-1 |
| debian 14 | git | 1:2.1.4-1 |
| debian 14 | jgit | 3.7.0-1 |
| debian 14 | libgit2 | 0.21.3-1 |
| debian 14 | mercurial | 3.1.2-2 |
| debian 7 | dulwich | düzeltme belirtilmemiş |
| debian 7 | git | düzeltme belirtilmemiş |
| debian 7 | jgit | düzeltme belirtilmemiş |
| debian 7 | mercurial | 2.2.2-4 |
| debian 8 | dulwich | düzeltme belirtilmemiş |
| debian 8 | jgit | düzeltme belirtilmemiş |
| debian 8 | libgit2 | 0.21.1-3 |
| echo | dulwich | 0.10.1-1 |
| echo | git | 1:2.1.4-1 |
| echo | jgit | 3.7.0-1 |
| echo | libgit2 | 0.21.3-1 |
| echo | mercurial | 3.1.2-2 |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
| root.io debian 13 | rootio-git | 1:2.1.4-1 |
| root.io ubuntu 22.04 | rootio-git | 1:2.1.4-2 |
| root.io ubuntu 24.04 | rootio-git | 1:2.1.4-2 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.1 |
| ubuntu 12.04 | mercurial | 2.0.2-1ubuntu1.2 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.1 |
| ubuntu 14.04 | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.04-ESM | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.10 | git | 1:2.1.0-1ubuntu0.1 |
| ubuntu 14.10 | mercurial | 3.1.1-1ubuntu0.2 |
| ubuntu 15.04 | git | 1:2.1.4-2 |
| ubuntu 15.10 | git | 1:2.1.4-2 |
| ubuntu 16.04 | git | 1:2.1.4-2 |
| ubuntu 16.04-ESM | git | 1:2.1.4-2 |
| ubuntu 16.10 | git | 1:2.1.4-2 |
| ubuntu 17.04 | git | 1:2.1.4-2 |
| ubuntu 17.10 | git | 1:2.1.4-2 |
| ubuntu 18.04 | git | 1:2.1.4-2 |
| ubuntu 18.04-ESM | git | 1:2.1.4-2 |
| ubuntu 18.10 | git | 1:2.1.4-2 |
| ubuntu 19.04 | git | 1:2.1.4-2 |
| ubuntu 19.10 | git | 1:2.1.4-2 |
| ubuntu 20.04 | git | 1:2.1.4-2 |
| ubuntu 20.04-ESM | git | 1:2.1.4-2 |
| ubuntu 20.10 | git | 1:2.1.4-2 |
| ubuntu 21.04 | git | 1:2.1.4-2 |
| ubuntu 21.10 | git | 1:2.1.4-2 |
| ubuntu 22.04 | git | 1:2.1.4-2 |
| ubuntu 22.10 | git | 1:2.1.4-2 |
| ubuntu 23.04 | git | 1:2.1.4-2 |
| ubuntu 23.10 | git | 1:2.1.4-2 |
| ubuntu 24.04 | git | 1:2.1.4-2 |
| ubuntu 24.10 | git | 1:2.1.4-2 |
| ubuntu 25.04 | git | 1:2.1.4-2 |
| ubuntu 25.10 | git | 1:2.1.4-2 |
| ubuntu 26.04 | git | 1:2.1.4-2 |
| ubuntu 26.10 | git | 1:2.1.4-2 |
Referanslar
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://access.redhat.com/security/cve/CVE-2014-9390
20 referansın hepsi
- https://developer.atlassian.com/blog/2014/12/securing-your-git-server/
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2020-217.yaml
- https://libgit2.org/security
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
- https://nvd.nist.gov/vuln/detail/CVE-2014-9390
- https://projects.eclipse.org/projects/technology.jgit/releases/3.5.3
- https://ubuntu.com/security/notices/USN-2470-1
- https://web.archive.org/web/20211204220400/https://securitytracker.com/id?1031404
- https://www.cve.org/CVERecord?id=CVE-2014-9390