CVE-2014-9390

Home/CVE/Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS

CVE

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X.

Mercurial before 3.2.3 on Windows and OS X.

Apple Xcode before 6.2 beta 3.

mine all versions before 08-12-2014.

libgit2 all versions up to 0.21.2.

Egit all versions before 08-12-2014.

and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

CRITICAL · CVSS 9.8 EPSS 0.77155

Act now

EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
EPSS percentile: top 1% of all CVEs by exploitation likelihood
CVSS base score ≥ 7.0

Sigma rules7 YARA rules0

⬡

Weakness Classification

CWE-20Improper Input Validation

▤

Affected Products & Versions

git-scm git< 1.8.5.6
git-scm git>= 1.9.0 and < 1.9.5
git-scm git>= 2.0.0 and < 2.0.5
git-scm git>= 2.1.0 and < 2.1.4
git-scm git>= 2.2.0 and < 2.2.1
mercurial< 3.2.3
apple xcode<= 6.1.1
apple xcodeall versions
Show all 12 affected productseclipse egit< 08-12-2014
eclipse jgit< 3.4.2
eclipse jgit>= 3.5.0 and < 3.5.3
libgit2< 0.21.3

▤

Affected Packages

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

Maven org.eclipse.jgit:org.eclipse.jgit CRITICAL fixed in 3.5.3

PyPI mercurial fixed in 3.2.3

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

productcriticalHackTool - Windows Credential Editor (WCE) Execution

productcriticalWindows Credential Editor Registry

producthighOpenCanary - MSSQL Login Attempt Via Windows Authentication

producthighWindows LAPS Credential Dump From Entra ID

producthighTamper Windows Defender - PSClassic

producthighTamper Windows Defender Remove-MpPreference - ScriptBlockLogging

Show all 7 top matches

producthighTamper Windows Defender - ScriptBlockLogging

▣