REDHAT-BUG-909977: Medium severity git vulnerability

Published Feb 11, 2013

Updated

A security flaw was found in the way git-imap-send command (tool to send a collection of patches from stdin to an IMAP folder) of Git performed IMAP server's SSL x509.v3 certificate validation (server's hostname was previously not verified to match the CN field of the particular certificate). A rogue server could use this flaw to conduct man-in-the-middle (MiTM) attacks, possibly leading to disclosure of sensitive information.

References: [1] https://www.kernel.org/pub/software/scm/git/docs/git-imap-send.html [2] https://github.com/git/git/blob/master/imap-send.c#L233

Affected Software

1 affected component

Git git

Event History

Feb 11, 2013

Data Sourced

via Red Hat·03:09 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-909977?

The severity of REDHAT-BUG-909977 is considered to be moderate due to the potential for certificate validation bypass.

How do I fix REDHAT-BUG-909977?

To fix REDHAT-BUG-909977, ensure you are using a patched version of Git that correctly validates IMAP server SSL certificate hostnames.

What systems are affected by REDHAT-BUG-909977?

REDHAT-BUG-909977 affects versions of Git that utilize the git-imap-send command without proper SSL certificate hostname verification.

What are the potential impacts of REDHAT-BUG-909977?

The potential impacts of REDHAT-BUG-909977 include the risk of man-in-the-middle attacks due to improper SSL certificate validation.

Is there a workaround for REDHAT-BUG-909977?

A temporary workaround for REDHAT-BUG-909977 may include avoiding the use of the git-imap-send command until the vulnerability is patched.