critical
CVE-2014-9390
git: arbitrary command execution vulnerability on case-insensitive file systems
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:P/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Photon OS. Rated lower by Ubuntu (medium), Red Hat (low).
Description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git, git-extras, git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich, git, jgit and 2 more | 0.10.1-1 and 4 more |
| debian 12 | dulwich, git, jgit and 2 more | 0.10.1-1 and 4 more |
| debian 13 | dulwich, git, jgit and 2 more | 0.10.1-1 and 4 more |
| debian 14 | dulwich, git, jgit and 2 more | 0.10.1-1 and 4 more |
| debian 7 | dulwich, git, jgit and 1 more | 2.2.2-4 |
| debian 8 | dulwich, jgit, libgit2 | 0.21.1-3 |
| echo | dulwich, git, jgit and 2 more | 0.10.1-1 and 4 more |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
Show all 76 entries from 46 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.eclipse.jgit:org.eclipse.jgit | 3.5.3 |
| Photon OS 5.0 | git | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-extras | 2.43.7-1.ph5 |
| Photon OS 5.0 | git-lang | 2.43.7-1.ph5 |
| pip::GitHub Security Advisory pip | mercurial | 3.2.3 |
| debian 11 | dulwich | 0.10.1-1 |
| debian 11 | git | 1:2.1.4-1 |
| debian 11 | jgit | 3.7.0-1 |
| debian 11 | libgit2 | 0.21.3-1 |
| debian 11 | mercurial | 3.1.2-2 |
| debian 12 | dulwich | 0.10.1-1 |
| debian 12 | git | 1:2.1.4-1 |
| debian 12 | jgit | 3.7.0-1 |
| debian 12 | libgit2 | 0.21.3-1 |
| debian 12 | mercurial | 3.1.2-2 |
| debian 13 | dulwich | 0.10.1-1 |
| debian 13 | git | 1:2.1.4-1 |
| debian 13 | jgit | 3.7.0-1 |
| debian 13 | libgit2 | 0.21.3-1 |
| debian 13 | mercurial | 3.1.2-2 |
| debian 14 | dulwich | 0.10.1-1 |
| debian 14 | git | 1:2.1.4-1 |
| debian 14 | jgit | 3.7.0-1 |
| debian 14 | libgit2 | 0.21.3-1 |
| debian 14 | mercurial | 3.1.2-2 |
| debian 7 | dulwich | no fix listed |
| debian 7 | git | no fix listed |
| debian 7 | jgit | no fix listed |
| debian 7 | mercurial | 2.2.2-4 |
| debian 8 | dulwich | no fix listed |
| debian 8 | jgit | no fix listed |
| debian 8 | libgit2 | 0.21.1-3 |
| echo | dulwich | 0.10.1-1 |
| echo | git | 1:2.1.4-1 |
| echo | jgit | 3.7.0-1 |
| echo | libgit2 | 0.21.3-1 |
| echo | mercurial | 3.1.2-2 |
| root.io debian 11 | rootio-git | 1:2.1.4-1 |
| root.io debian 12 | rootio-git | 1:2.1.4-1 |
| root.io debian 13 | rootio-git | 1:2.1.4-1 |
| root.io ubuntu 22.04 | rootio-git | 1:2.1.4-2 |
| root.io ubuntu 24.04 | rootio-git | 1:2.1.4-2 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.1 |
| ubuntu 12.04 | mercurial | 2.0.2-1ubuntu1.2 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.1 |
| ubuntu 14.04 | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.04-ESM | mercurial | 2.8.2-1ubuntu1.3 |
| ubuntu 14.10 | git | 1:2.1.0-1ubuntu0.1 |
| ubuntu 14.10 | mercurial | 3.1.1-1ubuntu0.2 |
| ubuntu 15.04 | git | 1:2.1.4-2 |
| ubuntu 15.10 | git | 1:2.1.4-2 |
| ubuntu 16.04 | git | 1:2.1.4-2 |
| ubuntu 16.04-ESM | git | 1:2.1.4-2 |
| ubuntu 16.10 | git | 1:2.1.4-2 |
| ubuntu 17.04 | git | 1:2.1.4-2 |
| ubuntu 17.10 | git | 1:2.1.4-2 |
| ubuntu 18.04 | git | 1:2.1.4-2 |
| ubuntu 18.04-ESM | git | 1:2.1.4-2 |
| ubuntu 18.10 | git | 1:2.1.4-2 |
| ubuntu 19.04 | git | 1:2.1.4-2 |
| ubuntu 19.10 | git | 1:2.1.4-2 |
| ubuntu 20.04 | git | 1:2.1.4-2 |
| ubuntu 20.04-ESM | git | 1:2.1.4-2 |
| ubuntu 20.10 | git | 1:2.1.4-2 |
| ubuntu 21.04 | git | 1:2.1.4-2 |
| ubuntu 21.10 | git | 1:2.1.4-2 |
| ubuntu 22.04 | git | 1:2.1.4-2 |
| ubuntu 22.10 | git | 1:2.1.4-2 |
| ubuntu 23.04 | git | 1:2.1.4-2 |
| ubuntu 23.10 | git | 1:2.1.4-2 |
| ubuntu 24.04 | git | 1:2.1.4-2 |
| ubuntu 24.10 | git | 1:2.1.4-2 |
| ubuntu 25.04 | git | 1:2.1.4-2 |
| ubuntu 25.10 | git | 1:2.1.4-2 |
| ubuntu 26.04 | git | 1:2.1.4-2 |
| ubuntu 26.10 | git | 1:2.1.4-2 |
References
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://access.redhat.com/security/cve/CVE-2014-9390
All 20 references
- https://developer.atlassian.com/blog/2014/12/securing-your-git-server/
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2020-217.yaml
- https://libgit2.org/security
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
- https://nvd.nist.gov/vuln/detail/CVE-2014-9390
- https://projects.eclipse.org/projects/technology.jgit/releases/3.5.3
- https://ubuntu.com/security/notices/USN-2470-1
- https://web.archive.org/web/20211204220400/https://securitytracker.com/id?1031404
- https://www.cve.org/CVERecord?id=CVE-2014-9390