CVE-2014-9938: High severity git vulnerability
Published Mar 20, 2017
·Updated
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.
Affected Software
2 affected componentsFixes available
redhat/git<1.9.3
1.9.3
git-scm Git<1.9.3
Remediation
Event History
Mar 20, 2017
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9938?
CVE-2014-9938 is considered a high severity vulnerability that allows code execution through unsanitized branch names in Git's PS1 variable.
2
How do I fix CVE-2014-9938?
To fix CVE-2014-9938, update Git to version 1.9.3 or later where the vulnerability has been addressed.
3
Which versions of Git are affected by CVE-2014-9938?
CVE-2014-9938 affects Git versions prior to 1.9.3.
4
What is the impact of CVE-2014-9938?
The impact of CVE-2014-9938 can lead to remote code execution if a user interacts with a malicious repository.
5
Can CVE-2014-9938 be exploited by a local user?
Yes, CVE-2014-9938 can be exploited by a local user who can execute commands within a Git environment with untrusted branches.