Vulnerability Name:

CVE-2014-9938 (CCN-127316)

Assigned:2014-04-22
Published:2014-04-22
Updated:2020-04-29
Summary:contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.9 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.0 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-116
CWE-78
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2014-9938

Source: CCN
Type: IBM Security Bulletin T1025756 (PowerKVM)
Vulnerabilities in git affect PowerKVM

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:2004

Source: XF
Type: UNKNOWN
git-cve20149938-code-exec(127316)

Source: CCN
Type: Git Repository
git-prompt.sh: don't put unsanitized branch names in $PS1

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f

Source: CCN
Type: pw3nage GIT Repository
If you get pw3ned, might want to fix your shell

Source: MISC
Type: Exploit, Third Party Advisory
https://github.com/njhartwell/pw3nage

Vulnerable Configuration:Configuration 1:
  • cpe:/a:git-scm:git:*:*:*:*:*:*:*:* (Version < 1.9.3)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20172004
    P
    		RHSA-2017:2004: git security and bug fix update (Moderate)
    2017-08-01
    oval:com.ubuntu.xenial:def:201499380000000
    V
    		CVE-2014-9938 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-03-20
    oval:com.ubuntu.precise:def:20149938000
    V
    		CVE-2014-9938 on Ubuntu 12.04 LTS (precise) - medium.
    2017-03-19
    oval:com.ubuntu.trusty:def:20149938000
    V
    		CVE-2014-9938 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-03-19
    oval:com.ubuntu.xenial:def:20149938000
    V
    		CVE-2014-9938 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-03-19
    BACK
    git-scm git *