CVE-2014-9390
Estado: ModificadaCrítica (9.8)—
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 76%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (6)
CWE
- CWE-20
Referencias
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://securitytracker.com/id?1031404
- http://support.apple.com/kb/HT204147
- https://github.com/blog/1938-git-client-vulnerability-announced
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://libgit2.org/security/
- https://news.ycombinator.com/item?id=8769667
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-9390",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2020-02-12T02:15:10.963",
"references": [
{
"url": "http://article.gmane.org/gmane.linux.kernel/1853266",
"tags": [
"Broken Link"
],
"source": "cve@mitre.org"
},
{
"url": "http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://mercurial.selenic.com/wiki/WhatsNew",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://securitytracker.com/id?1031404",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT204147",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/blog/1938-git-client-vulnerability-announced",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://libgit2.org/security/",
"tags": [
"Product"
],
"source": "cve@mitre.org"
},
{
"url": "https://news.ycombinator.com/item?id=8769667",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://article.gmane.org/gmane.linux.kernel/1853266",
"tags": [
"Broken Link"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://mercurial.selenic.com/wiki/WhatsNew",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securitytracker.com/id?1031404",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT204147",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/blog/1938-git-client-vulnerability-announced",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://libgit2.org/security/",
"tags": [
"Product"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://news.ycombinator.com/item?id=8769667",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem."
},
{
"lang": "es",
"value": "Git versiones anteriores a 1.8.5.6, versiones 1.9.x anteriores a 1.9.5, versiones 2.0.x anteriores a 2.0.5, versiones 2.1.x anteriores a 2.1.4 y versiones 2.2.x anteriores a 2.2.1 en Windows y OS X; Mercurial versiones anteriores a 3.2.3 en Windows y OS X; Apple Xcode versiones anteriores a 6.2 beta 3; mine todas las versiones antes del 08-12-2014; libgit2 todas las versiones hasta 0.21. 2; Egit todas las versiones anteriores al 08-12-2014; y JGit todas las versiones anteriores al 08-12-2014 permiten a los servidores Git remotos ejecutar comandos arbitrarios por medio de un árbol que contiene un archivo .git/config diseñado con (1) un punto de código Unicode ignorable, (2) una representación git~1/config, o (3) mayúsculas y minúsculas que no son manejadas apropiadamente en un sistema de archivos insensible a mayúsculas y minúsculas"
}
],
"lastModified": "2026-06-17T00:18:16.477",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDA7AD30-7C02-418F-A62D-9C4C179088DB",
"versionEndExcluding": "1.8.5.6"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "639D829A-5F78-49EB-924E-F6495EEB5153",
"versionEndExcluding": "1.9.5",
"versionStartIncluding": "1.9.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9080C10B-548A-45AF-9B62-F80B92EEB4F4",
"versionEndExcluding": "2.0.5",
"versionStartIncluding": "2.0.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "853D6A11-7FA6-4A92-87E2-6F7756E1C96A",
"versionEndExcluding": "2.1.4",
"versionStartIncluding": "2.1.0"
},
{
"criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDEC04F1-09CA-4957-90B6-5D87A68C2C06",
"versionEndExcluding": "2.2.1",
"versionStartIncluding": "2.2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD"
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99B4890E-102C-442D-AB16-4D859A595656",
"versionEndExcluding": "3.2.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD"
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DDD1870-453C-4B97-BE7B-9B3D6D4856D4",
"versionEndIncluding": "6.1.1"
},
{
"criteria": "cpe:2.3:a:apple:xcode:6.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D061C24-F869-456D-8D26-8B6F63B6C834"
},
{
"criteria": "cpe:2.3:a:apple:xcode:6.2:beta_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CD44704-4632-43DC-BC56-F872BCAF3E97"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:eclipse:egit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB77E9A5-6A32-42BE-81C0-7D87A2076688",
"versionEndExcluding": "08-12-2014"
},
{
"criteria": "cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5351751-FCFD-429E-8FF4-B8E9954D7248",
"versionEndExcluding": "3.4.2"
},
{
"criteria": "cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1B88228-1044-4794-A954-A1CA8954D1BA",
"versionEndExcluding": "3.5.3",
"versionStartIncluding": "3.5.0"
},
{
"criteria": "cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "973A3E4A-6E15-4137-9933-4609A9CC805C",
"versionEndExcluding": "0.21.3"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}