CVE-2014-9390
Description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
How to fix
- mercurial mercurial3.2.3 or later
- git-scm git1.8.5.6, 1.9.5, 2.0.5, 2.1.4, 2.2.1 or later
- eclipse egit08-12-2014 or later
- eclipse jgit3.4.2, 3.5.3 or later
- libgit2 libgit20.21.3 or later
- org.eclipse.jgit:org.eclipse.jgit3.5.3 or later
- mercurial3.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mercurial mercurial | v < 3.2.3 | 3.2.3 |
| git-scm git | v < 1.8.5.6, 1.9.0 ≤ v < 1.9.5, 2.0.0 ≤ v < 2.0.5, 2.1.0 ≤ v < 2.1.4, 2.2.0 ≤ v < 2.2.1 | 1.8.5.6, 1.9.5, 2.0.5, 2.1.4, 2.2.1 |
| apple xcode | v ≤ 6.1.1, 6.2 | — |
| eclipse egit | v < 08-12-2014 | 08-12-2014 |
| eclipse jgit | v < 3.4.2, 3.5.0 ≤ v < 3.5.3 | 3.4.2, 3.5.3 |
| libgit2 libgit2 | v < 0.21.3 | 0.21.3 |
| org.eclipse.jgit:org.eclipse.jgitMaven | v < 3.5.3 | 3.5.3 |
| mercurialPyPI | v < 3.2.3 | 3.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.