REDHAT-BUG-909977
First published: Mon Feb 11 2013(Updated: )
A security flaw was found in the way git-imap-send command (tool to send a collection of patches from stdin to an IMAP folder) of Git performed IMAP server's SSL x509.v3 certificate validation (server's hostname was previously not verified to match the CN field of the particular certificate). A rogue server could use this flaw to conduct man-in-the-middle (MiTM) attacks, possibly leading to disclosure of sensitive information. References: [1] <a href="https://www.kernel.org/pub/software/scm/git/docs/git-imap-send.html">https://www.kernel.org/pub/software/scm/git/docs/git-imap-send.html</a> [2] <a href="https://github.com/git/git/blob/master/imap-send.c#L233">https://github.com/git/git/blob/master/imap-send.c#L233</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Git |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.kernel.org/pub/software/scm/git/docs/git-imap-send.html
- https://github.com/git/git/blob/master/imap-send.c#L233
- https://access.redhat.com/security/cve/CVE-2013-0308
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=699610&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=699610&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=699611&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=699611&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=699612&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=699612&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=700017&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=700017&action=edit
- https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt
- http://marc.info/?l=git&m=136134619013145&w=2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=913593
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=913595
- https://rhn.redhat.com/errata/RHSA-2013-0589.html
- https://bugzilla.redhat.com/show_bug.cgi?id=909977
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-0308
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/git
- canonical/git