--- title: "CVE-2014-9390\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2014-9390?format=md keywords: index, follow --- # CVE-2014-9390 Publication date 19 December 2014 Last updated 18 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **9.8 · Critical** [Score breakdown](https://ubuntu.com/security/CVE-2014-9390?format=md#impact-score) Toggle side navigation ## Description Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. [Read the notes from the security team](https://ubuntu.com/security/CVE-2014-9390?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | git | 26.04 LTS resolute | Fixed 1:2.1.4-2 | | 25.10 questing | Fixed 1:2.1.4-2 | | 25.04 plucky | Fixed 1:2.1.4-2 | | 24.10 oracular | Fixed 1:2.1.4-2 | | 24.04 LTS noble | Fixed 1:2.1.4-2 | | 23.10 mantic | Fixed 1:2.1.4-2 | | 23.04 lunar | Fixed 1:2.1.4-2 | | 22.10 kinetic | Fixed 1:2.1.4-2 | | 22.04 LTS jammy | Fixed 1:2.1.4-2 | | 21.10 impish | Fixed 1:2.1.4-2 | | 21.04 hirsute | Fixed 1:2.1.4-2 | | 20.10 groovy | Fixed 1:2.1.4-2 | | 20.04 LTS focal | Fixed 1:2.1.4-2 | | 19.10 eoan | Fixed 1:2.1.4-2 | | 19.04 disco | Fixed 1:2.1.4-2 | | 18.10 cosmic | Fixed 1:2.1.4-2 | | 18.04 LTS bionic | Fixed 1:2.1.4-2 | | 17.10 artful | Fixed 1:2.1.4-2 | | 17.04 zesty | Fixed 1:2.1.4-2 | | 16.10 yakkety | Fixed 1:2.1.4-2 | | 16.04 LTS xenial | Fixed 1:2.1.4-2 | | 15.10 wily | Fixed 1:2.1.4-2 | | 15.04 vivid | Fixed 1:2.1.4-2 | | 14.10 utopic | Fixed 1:2.1.0-1ubuntu0.1 | | 14.04 LTS trusty | Fixed 1:1.9.1-1ubuntu0.1 | | 12.04 LTS precise | Fixed 1:1.7.9.5-1ubuntu0.1 | | 10.04 LTS lucid | Not in release | | git-core | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 17.10 artful | Not in release | | 17.04 zesty | Not in release | | 16.10 yakkety | Not in release | | 16.04 LTS xenial | Not in release | | 15.10 wily | Not in release | | 15.04 vivid | Not in release | | 14.10 utopic | Not in release | | 14.04 LTS trusty | Not in release | | 12.04 LTS precise | Not in release | | 10.04 LTS lucid | Ignored end of life | | jgit | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Not affected | | 19.10 eoan | Not affected | | 19.04 disco | Not affected | | 18.10 cosmic | Not affected | | 18.04 LTS bionic | Not affected | | 17.10 artful | Ignored end of life | | 17.04 zesty | Ignored end of life | | 16.10 yakkety | Ignored end of life | | 16.04 LTS xenial | Not affected | | 15.10 wily | Ignored end of life | | 15.04 vivid | Ignored end of life | | 14.10 utopic | Ignored end of life | | 14.04 LTS trusty | Not in release | | 12.04 LTS precise | Not in release | | 10.04 LTS lucid | Not in release | | libgit2 | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Not affected | | 19.10 eoan | Not affected | | 19.04 disco | Not affected | | 18.10 cosmic | Not affected | | 18.04 LTS bionic | Not affected | | 17.10 artful | Ignored end of life | | 17.04 zesty | Ignored end of life | | 16.10 yakkety | Ignored end of life | | 16.04 LTS xenial | Not affected | | 15.10 wily | Ignored end of life | | 15.04 vivid | Ignored end of life | | 14.10 utopic | Ignored end of life | | 14.04 LTS trusty | Vulnerable | | 12.04 LTS precise | Not in release | | 10.04 LTS lucid | Not in release | | mercurial | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Not affected | | 19.10 eoan | Not affected | | 19.04 disco | Not affected | | 18.10 cosmic | Not affected | | 18.04 LTS bionic | Not affected | | 17.10 artful | Not affected | | 17.04 zesty | Not affected | | 16.10 yakkety | Not affected | | 16.04 LTS xenial | Not affected | | 15.10 wily | Not affected | | 15.04 vivid | Not affected | | 14.10 utopic | Fixed 3.1.1-1ubuntu0.2 | | 14.04 LTS trusty | Fixed 2.8.2-1ubuntu1.3 | | 12.04 LTS precise | Fixed 2.0.2-1ubuntu1.2 | | 10.04 LTS lucid | Ignored end of life | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2014-9390?format=md#patch-details) ## Notes --- ### [kees](https://launchpad.net/~kees) This CVE is about the git VCS. The "git" from hardy and earlier is not what was "git-core". --- ### [jdstrand](https://launchpad.net/~jdstrand) Maverick and later renamed 'git-core' to 'git', so 'git' in these releases does refer to git VCS. initially marked 'low' since default filesystems on Ubuntu are case-sensitive, however file servers serving these reopositories to clients need to be patched, so upping to medium --- ### [tyhicks](https://launchpad.net/~tyhicks) git upstream fixed a minor regression in the HFS+ .git filtering with commit 6aaf956b ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | git | * Upstream: [?id=461](https://git.kernel.org/cgit/git/git.git/commit/?id=4616918013bf4fb3ce61175702d963a1fdd87f84) * Upstream: [?id=96b](https://git.kernel.org/cgit/git/git.git/commit/?id=96b50cc19003d54f5962d65597c94e2c52eb22e7) * Upstream: [?id=cc2](https://git.kernel.org/cgit/git/git.git/commit/?id=cc2fc7c2f07c4a2aba5a653137ac9b489e05df43) * Upstream: [?id=450](https://git.kernel.org/cgit/git/git.git/commit/?id=450870cba7a9bac94b5527021800bd8bf037c99c) * Upstream: [?id=76e](https://git.kernel.org/cgit/git/git.git/commit/?id=76e86fc6e3523d28e8db00e7b10c33c553d996b8) * Upstream: [?id=616](https://git.kernel.org/cgit/git/git.git/commit/?id=6162a1d323d24fd8cbbb1a6145a91fb849b2568f) * Upstream: [?id=a42](https://git.kernel.org/cgit/git/git.git/commit/?id=a42643aa8d88a2278acad2da6bc702e426476e9b) * Upstream: [?id=a18](https://git.kernel.org/cgit/git/git.git/commit/?id=a18fcc9ff22b714e7df30c400c05542f52830eb0) * Upstream: [?id=1d1](https://git.kernel.org/cgit/git/git.git/commit/?id=1d1d69bc52dcc7def5b2edbd165cc0a4e3911c8e) * Upstream: [?id=2b4](https://git.kernel.org/cgit/git/git.git/commit/?id=2b4c6efc82119ba8f4169717473d95d1a89e4c69) * Upstream: [?id=d08](https://git.kernel.org/cgit/git/git.git/commit/?id=d08c13b947335cc48ecc1a8453d97b7147c2d6d6) * Upstream: [?id=6aa](https://git.kernel.org/cgit/git/git.git/commit/?id=6aaf956b08cfab2dcaa1a1afe4192390d0ef14fd) | | mercurial | * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 9.8 · Critical * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | High | | Integrity impact | High | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 9.8 · Critical | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9390) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-9390) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-9390) * [Debian](https://security-tracker.debian.org/tracker/CVE-2014-9390) ### Related Ubuntu Security Notices (USN) + [USN-2470-1](https://usn.ubuntu.com/USN-2470-1) + Git vulnerability + 14 January 2015 ### Other references * * * * *