Insufficiently protected credentials in Git - CVE-2020-5260

Vulnerability identifier: #VU27258

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-5260

CWE-ID: CWE-522

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to the Git can be tricked into sending private credentials to a host controlled by an attacker. A remote attacker can send a specially crafted URL to "git clone" that will present stored credentials for any host to a host of their choosing.

Git
Arch Linux
Debian Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
CentOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Slackware Linux
Opensuse
openEuler
Fedora
git (Alpine package)
git (Red Hat package)
rh-git218-git (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
git (Debian package)
git
git-gui
perl-Git-SVN
perl-Git
gitk
git-web
git-svn
git-help
git-email
git-debugsource
git-debuginfo
git-daemon
git-core
git-instaweb
gitweb
git-core-doc
git-all
git-subtree
git-credential-libsecret
Sourcetree for Windows
Sourcetree for macOS
IBM Qradar SIEM

Install updates from vendor's website.

Git - addressed in versions 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1
Sourcetree for Windows - update to 3.3.9
Sourcetree for macOS - update to 4.0.2
git (Red Hat package) - addressed in versions 1.8.3.1-22.el7_8, 1.8.3.1-23.el7_7, 2.18.2-2.el8_0, 2.18.2-2.el8_1
git (Alpine package) - addressed in versions 2.18.3-r0, 2.20.3-r0
rh-git218-git (Red Hat package) - update to 2.18.2-3.el7
IBM Qradar SIEM - update to 7.5.0 Update Pack 13 IF01
git (Debian package) - addressed in versions 1:2.11.0-3+deb9u6, 1:2.20.1-2+deb10u2
git - addressed in versions 2.21.2-1.fc30, 2.21.3-1.fc30, 2.25.3-1.fc31, 2.25.4-1.fc31, 2.26.1-1.fc32, 2.26.2-1.fc32
git-gui - addressed in versions 2.23.0-16, 2.43.0-6
perl-Git-SVN - addressed in versions 2.23.0-16, 2.43.0-6
perl-Git - addressed in versions 2.23.0-16, 2.43.0-6
gitk - addressed in versions 2.23.0-16, 2.43.0-6
git-web - addressed in versions 2.23.0-16, 2.43.0-6
git-svn - addressed in versions 2.23.0-16, 2.43.0-6
git-help - addressed in versions 2.23.0-16, 2.43.0-6
git-email - addressed in versions 2.23.0-16, 2.43.0-6
git-debugsource - addressed in versions 2.23.0-16, 2.43.0-6
git-debuginfo - addressed in versions 2.23.0-16, 2.43.0-6
git-daemon - addressed in versions 2.23.0-16, 2.43.0-6
git - addressed in versions 2.23.0-16, 2.43.0-6
git-core - update to 2.43.0-6
git-email - update to 2.43.7-1.0.1
git-daemon - update to 2.43.7-1.0.1
git-gui - update to 2.43.7-1.0.1
git-instaweb - update to 2.43.7-1.0.1
git-svn - update to 2.43.7-1.0.1
gitk - update to 2.43.7-1.0.1
gitweb - update to 2.43.7-1.0.1
perl-Git - update to 2.43.7-1.0.1
perl-Git-SVN - update to 2.43.7-1.0.1
git-core-doc - update to 2.43.7-1.0.1
git-all - update to 2.43.7-1.0.1
git-subtree - update to 2.43.7-1.0.1
git-credential-libsecret - update to 2.43.7-1.0.1
git-core - update to 2.43.7-1.0.1
git - update to 2.43.7-1.0.1

• Exploit #2927 - CVE-2020-5260 (https://bugs.chromium.org/p/project-zero/issues/detail?id=2021) (June 3, 2020)
• Exploit #2931 - cve-2020-5260 (A HTTP PoC Endpoint for cve-2020-5260 which can be deployed to Heroku) (June 3, 2020)
• Exploit #2932 - CVE-2020-5260 (CVE-2020-5260演示记录) (June 3, 2020)

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html
• http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html
• http://www.openwall.com/lists/oss-security/2020/04/15/5
• http://www.openwall.com/lists/oss-security/2020/04/15/6
• http://www.openwall.com/lists/oss-security/2020/04/20/1
• https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b
• https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
• https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/
• https://lore.kernel.org/git/xmqqy2qy7xn8.fsf@gitster.c.googlers.com/
• https://support.apple.com/kb/HT211141
• https://www.debian.org/security/2020/dsa-4657

• Arch Linux update for git
• Arch Linux update for git
• Slackware Linux update for git
• Insufficiently protected credentials in Git
• Gentoo update for Git
• Arch Linux update for git
• Amazon Linux AMI update for git
• Slackware Linux update for git
• OpenSUSE Linux update for git
• CentOS 7 update for git
• OpenSUSE Linux update for git
• Amazon Linux AMI update for git
• Red Hat Software Collections update for rh-git218-git
• Red Hat Enterprise Linux 8 update for git
• Insufficiently protected credentials in git (Alpine package)
• Red Hat Enterprise Linux 7 update for git
• Atlassian Sourcetree security update for git
• Debian update for git
• Red Hat Enterprise Linux 7 update for git
• Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions update for git
• openEuler 20.03 LTS update for git
• openEuler update for git
• Fedora 31 update for git
• Fedora 30 update for git
• Fedora 32 update for git
• Fedora 31 update for git
• Fedora 32 update for git
• Fedora 30 update for git
• Anolis OS update for git
• Multiple vulnerabilities in IBM QRadar SIEM