Input validation error in Git - CVE-2014-9938

Vulnerability identifier: #VU39436

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-9938

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.

Git
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server for ARM
git
git (Red Hat package)

Install update from vendor's website.

Git - update to 1.9.3
git - update to 1.8.2.3-2.el5
git (Red Hat package) - update to 1.8.3.1-11.el7

• https://access.redhat.com/errata/RHSA-2017:2004
• https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f
• https://github.com/njhartwell/pw3nage

• Input validation error in Git
• Fedora EPEL 5 update for git
• Red Hat Enterprise Linux 7 update for git