CVE-2013-0308: Input Validation
A security flaw was found in the way git-imap-send command (tool to send a collection of patches from stdin to an IMAP folder) of Git performed IMAP server's SSL x509.v3 certificate validation (server's hostname was previously not verified to match the CN field of the particular certificate). A rogue server could use this flaw to conduct man-in-the-middle (MiTM) attacks, possibly leading to disclosure of sensitive information.
References: [1] https://www.kernel.org/pub/software/scm/git/docs/git-imap-send.html [2] https://github.com/git/git/blob/master/imap-send.c#L233
Other sources
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0308?
CVE-2013-0308 has a medium severity rating due to the potential for man-in-the-middle attacks.
How do I fix CVE-2013-0308?
To fix CVE-2013-0308, upgrade to Git version 1.8.2 or later, where the issue has been resolved.
What systems are affected by CVE-2013-0308?
CVE-2013-0308 affects Git versions up to and including 1.8.1.3.
What does CVE-2013-0308 affect in Git?
CVE-2013-0308 affects the git-imap-send command's ability to properly validate SSL x509.v3 certificates.
Is there a workaround for CVE-2013-0308?
While the best solution is to upgrade, users can avoid the issue by using alternative methods for sending patches until an upgrade is feasible.