CVE-2014-9390 JGit Improper Input Validation vulnerability
Remote Git servers can execute arbitrary commands on Windows and OS X clients via crafted .git/config files exploiting case-insensitive filesystems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9390?
CVE-2014-9390 is a critical command injection vulnerability in Apple Xcode, published on 12 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Weakness: CWE-20
Which versions are affected by CVE-2014-9390?
5 open source packages ship an affected version, including mercurial and org.eclipse.jgit:org.eclipse.jgit. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
mercurial PyPI | All versions | 3.2.3 |
mercurial PyPI | All versions | 3.2.3 |
mercurial PyPI | All versions | 3.2.3 |
org.eclipse.jgit:org.eclipse.jgit Maven | All versions | 3.5.3 |
org.eclipse.jgit:org.eclipse.jgit Maven | All versions | 3.5.3 |
Products include Apple Xcode, Eclipse Egit, Eclipse Jgit, Git-Scm Git, Libgit2 Libgit2, Mercurial Mercurial.
How do I fix CVE-2014-9390?
Upgrade mercurial to 3.2.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-9390 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-9390 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Apple Xcode
Sources
Also known as DEBIAN-CVE-2014-9390, GHSA-6vvc-c2m3-cjf3, MGASA-2014-0546, MGASA-2015-0325, PYSEC-2020-217, UBUNTU-CVE-2014-9390 and 1 more.