Skip to content
OpenAdvisories
High ALAS2-2020-1409 1 CVE

Important: git security update (Amazon Linux 2)

Published Apr 13, 2020 · Updated Apr 15, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol.

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 git 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-all 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-core 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-core-doc 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-cvs 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-daemon 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-debuginfo 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-email 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-gui 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-instaweb 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-p4 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-subtree 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 git-svn 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 gitk 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 gitweb 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 perl-Git 0:2.23.1-1.amzn2.0.2
Amazon Linux · 2 perl-Git-SVN 0:2.23.1-1.amzn2.0.2

Vulnerabilities 1

  • Critical 9.3
    CVE-2020-5260 Public exploit EPSS 15%

    malicious URLs may cause Git to present stored credentials to the wrong server

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure stor…

    git git git git Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-5260.html