Skip to content
OpenAdvisories
High ELSA-2020-1513 1 CVE

Important: git security update (Oracle Linux 8)

Published Apr 21, 2020 · Updated Apr 21, 2020

Ecosystem: Oracle Linux

Summary

[2.18.2-2]
- Crafted URL containing new lines can cause credential leak
- Resolves: CVE-2020-5260

Fixed packages 14

ReleasePackageFixed in
Oracle Linux · 8 git 0:2.18.2-2.el8_1
Oracle Linux · 8 git-all 0:2.18.2-2.el8_1
Oracle Linux · 8 git-core 0:2.18.2-2.el8_1
Oracle Linux · 8 git-core-doc 0:2.18.2-2.el8_1
Oracle Linux · 8 git-daemon 0:2.18.2-2.el8_1
Oracle Linux · 8 git-email 0:2.18.2-2.el8_1
Oracle Linux · 8 git-gui 0:2.18.2-2.el8_1
Oracle Linux · 8 git-instaweb 0:2.18.2-2.el8_1
Oracle Linux · 8 git-subtree 0:2.18.2-2.el8_1
Oracle Linux · 8 git-svn 0:2.18.2-2.el8_1
Oracle Linux · 8 gitk 0:2.18.2-2.el8_1
Oracle Linux · 8 gitweb 0:2.18.2-2.el8_1
Oracle Linux · 8 perl-Git 0:2.18.2-2.el8_1
Oracle Linux · 8 perl-Git-SVN 0:2.18.2-2.el8_1

Vulnerabilities 1

  • Critical 9.3
    CVE-2020-5260 Public exploit EPSS 15%

    malicious URLs may cause Git to present stored credentials to the wrong server

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure stor…

    git git git git Debian Ubuntu Alpine