{"id":"CVE-2014-9390","aliases":["DEBIAN-CVE-2014-9390","DLA-237-1","EUVD-2020-0110","GHSA-6vvc-c2m3-cjf3","MGASA-2014-0546","MGASA-2015-0325","PYSEC-2020-217","UBUNTU-CVE-2014-9390","USN-2470-1","openSUSE-SU-2024:10099-1"],"status":"published","title":"JGit Improper Input Validation vulnerability","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.75597,"percentile":0.99522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2014-12-19T00:00:00Z","modified":"2026-10-23T16:02:22Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/git_client_command_exec","title":"Malicious Git and Mercurial HTTP Server For CVE-2014-9390","type":"exploit","platform":"Unix,Windows","date":"2014-12-18","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/git_client_command_exec"}],"fixes":[{"ecosystem":"Maven","package":"org.eclipse.jgit:org.eclipse.jgit","fixed_in":["3.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"mercurial","fixed_in":["3.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"git","fixed_in":["1:2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"git","fixed_in":["1:2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"git","fixed_in":["1:2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jgit","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jgit","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jgit","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgit2","fixed_in":["0.21.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgit2","fixed_in":["0.21.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgit2","fixed_in":["0.21.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mercurial","fixed_in":["3.1.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mercurial","fixed_in":["3.1.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mercurial","fixed_in":["3.1.2-2"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"git","fixed_in":["1.8.5.6-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"cgit","fixed_in":["0.11.2-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"cgit","fixed_in":["0.11.2-1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"git","fixed_in":["1:1.9.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","fixed_in":["2.8.2-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jgit:org.eclipse.jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1+deb6u1"}]}],"versions":["1.6.4-1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jgit:org.eclipse.jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3"}]}],"versions":["1.2.0.201112221803-r","1.3.0.201202151440-r","2.0.0.201206130900-r","2.1.0.201209190230-r","2.2.0.201212191850-r","2.3.1.201302201838-r","3.0.0.201306101825-r","3.1.0.201310021548-r","3.2.0.201312181205-r","3.3.0.201403021825-r","3.3.1.201403241930-r","3.3.2.201404171909-r","3.4.0.201405051725-m7","3.4.0.201405211411-rc1","3.4.0.201405281120-rc2","3.4.0.201406041058-rc3","3.4.0.201406110918-r","3.4.1.201406201815-r","3.4.2.201412180340-r","3.5.0.201409071800-rc1","3.5.0.201409260305-r","3.5.1.201410131835-r","3.5.2.201411120430-r"]},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Mageia:4","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5.6-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"cgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"cgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.1-1ubuntu0.1"}]}],"versions":["1:1.8.3.2-1","1:1.8.4.2-1","1:1.8.4.3-1","1:1.8.4.4-1","1:1.8.5-1","1:1.8.5.1-1","1:1.8.5.2-1","1:1.8.5.2-2","1:1.8.5.3-1","1:1.9~rc1-1","1:1.9.0-1","1:1.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1ubuntu1.3"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-2","0.19.0-2ubuntu0.4","0.19.0-2ubuntu0.4+esm1","0.19.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.1-1ubuntu0.1"}]}],"versions":["1:1.8.3.2-1","1:1.8.4.2-1","1:1.8.4.3-1","1:1.8.4.4-1","1:1.8.5-1","1:1.8.5.1-1","1:1.8.5.2-1","1:1.8.5.2-2","1:1.8.5.3-1","1:1.9~rc1-1","1:1.9.0-1","1:1.9.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"xcode"},{"vendor":"eclipse","product":"egit"},{"vendor":"eclipse","product":"jgit"},{"vendor":"git-scm","product":"git"},{"vendor":"libgit2","product":"libgit2"},{"vendor":"mercurial","product":"mercurial"}],"references":[{"url":"https://news.ycombinator.com/item?id=8769667","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report","web"]},{"url":"http://article.gmane.org/gmane.linux.kernel/1853266","tags":["x_refsource_MISC","x_transferred","Broken Link","web","report"]},{"url":"http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","article"]},{"url":"http://mercurial.selenic.com/wiki/WhatsNew","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"http://support.apple.com/kb/HT204147","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/blog/1938-git-client-vulnerability-announced","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://securitytracker.com/id?1031404","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","fix"]},{"url":"https://libgit2.org/security/","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9390","tags":["advisory"]},{"url":"https://projects.eclipse.org/projects/technology.jgit/releases/3.5.3","tags":["web"]},{"url":"https://web.archive.org/web/20211204220400/https://securitytracker.com/id?1031404","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2020-217.yaml","tags":["web"]},{"url":"https://libgit2.org/security","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6vvc-c2m3-cjf3","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9390","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0546.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1175960","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2015-0325.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16180","tags":["report"]},{"url":"http://lists.zx2c4.com/pipermail/cgit/2015-March/002448.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9390","tags":["report"]},{"url":"http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html","tags":["report"]},{"url":"http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29","tags":["report"]},{"url":"https://developer.atlassian.com/blog/2014/12/securing-your-git-server/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2470-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9390","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2324","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9390","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2020-02-12T01:58:27Z","modified":"2024-08-06T13:40:25.038Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2020-0110","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2020-02-12T01:58:27Z","modified":"2024-08-06T13:40:25Z","updated_at":"2026-11-03T01:56:49.310799Z"}],"ghsa":[{"id":"GHSA-6vvc-c2m3-cjf3","title":"JGit Improper Input Validation vulnerability","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2022-05-17T19:57:29Z","modified":"2024-09-25T19:55:48Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2014-9390","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2020-02-12T02:15:10.963Z","modified":"2026-06-17T00:18:16.477Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-9390","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2020-02-12T02:15:10Z","modified":"2026-04-16T06:18:45.069008885Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9390","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2020-02-12T02:15:10.963Z","modified":"2026-10-23T16:02:22.506559445Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"GHSA-6vvc-c2m3-cjf3","title":"JGit Improper Input Validation vulnerability","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2022-05-17T19:57:29Z","modified":"2024-09-25T20:01:24.02873Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"UBUNTU-CVE-2014-9390","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2014-12-19T00:00:00Z","modified":"2026-08-13T02:54:49.870984132Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"DLA-237-1","title":"mercurial - security update","status":"published","published":"2015-06-04T00:00:00Z","modified":"2026-03-09T01:18:18.278529Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2014-0546","title":"Updated git packages fix security vulnerability","description":"It was reported that git, when used as a client on a case-insensitive\nfilesystem, could allow the overwrite of the .git/config file when the client\nperformed a \"git pull\".  Because git permitted committing .Git/config (or any\ncase variation), on the pull this would replace the user's .git/config.  If\nthis malicious config file contained defined external commands (such as for\ninvoking and editor or an external diff utility) it could allow for the\nexecution of arbitrary code with the privileges of the user running the git\nclient (CVE-2014-9390).\n","status":"published","published":"2014-12-23T20:35:35Z","modified":"2026-04-16T06:23:41.998125769Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0325","title":"Updated cgit package fixes security vulnerability","description":"cgit in Mageia 4/5 bundles an old git that is being subject to a minor\nsecurity issue (CVE-2014-9390). The cgit package was updated to its latest\nupstream release, and updates the bundled git to the non-vulnerable\nversion 2.5.0, which contains various bug fixes.\n","status":"published","published":"2015-08-26T20:36:28Z","modified":"2026-04-16T06:25:31.858455673Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10099-1","title":"git-2.11.0-1.1 on GA media","description":"These are all security issues fixed in the git-2.11.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:16.608031Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"PYSEC-2020-217","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","status":"published","published":"2020-02-12T02:15:00Z","modified":"2026-06-10T17:01:24.065182218Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"USN-2470-1","title":"git vulnerability","description":"Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain\nfilesystem paths. A remote attacker could possibly use this issue to execute\narbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The\nremote attacker would need write access to a Git repository that the victim\npulls from.\n","status":"published","published":"2015-01-14T00:44:38Z","modified":"2026-04-27T15:04:15.243799Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}