id: PYSEC-2020-217
details: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before
  2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows
  and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2
  all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions
  before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree
  containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2)
  a git~1/config representation, or (3) mixed case that is improperly handled on a
  case-insensitive filesystem.
affected:
- package:
    name: mercurial
    ecosystem: PyPI
    purl: pkg:pypi/mercurial
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.2.3
  versions:
  - 0.8.1
  - "0.9"
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 0.9.4
  - 0.9.5
  - "1.0"
  - 1.0.1
  - 1.0.2
  - "1.1"
  - 1.1.1
  - 1.1.2
  - "1.2"
  - 1.2.1
  - "1.3"
  - 1.3.1
  - "1.4"
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - "1.5"
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - "1.6"
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - "1.7"
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.5
  - "1.8"
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - "1.9"
  - 1.9.1
  - 1.9.2
  - 1.9.3
  - "2.0"
  - 2.0.1
  - 2.0.2
  - "2.1"
  - 2.1.1
  - 2.1.2
  - "2.2"
  - 2.2.2
  - "2.3"
  - 2.4.1
  - "2.5"
  - 2.5.1
  - 2.5.2
  - "2.6"
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - "2.8"
  - 2.8.1
  - 2.8.2
  - "2.9"
  - 2.9.1
  - "3.0"
  - 3.0.1
  - "3.1"
  - 3.1.1
  - 3.1.2
  - "3.2"
  - 3.2.1
  - 3.2.2
references:
- type: WEB
  url: https://news.ycombinator.com/item?id=8769667
- type: ARTICLE
  url: http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- type: ARTICLE
  url: https://github.com/blog/1938-git-client-vulnerability-announced
- type: WEB
  url: http://securitytracker.com/id?1031404
- type: WEB
  url: http://article.gmane.org/gmane.linux.kernel/1853266
- type: WEB
  url: http://mercurial.selenic.com/wiki/WhatsNew
- type: WEB
  url: http://support.apple.com/kb/HT204147
- type: WEB
  url: https://libgit2.org/security/
- type: FIX
  url: 
    https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6vvc-c2m3-cjf3
aliases:
- CVE-2014-9390
- GHSA-6vvc-c2m3-cjf3
modified: "2021-07-25T23:34:39.934367Z"
published: "2020-02-12T02:15:00Z"