Summary
[1.8.3.1-23]
- Prevent crafted URL containing new lines, empty host or lacks a scheme
to cause credential leak.
Resolves: CVE-2020-11008
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | emacs-git | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | emacs-git-el | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-all | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-bzr | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-cvs | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-daemon | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-email | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-gnome-keyring | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-gui | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-hg | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-instaweb | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-p4 | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | git-svn | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | gitk | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | gitweb | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | perl-Git | 0:1.8.3.1-23.el7_8 |
| Oracle Linux · 7 | perl-Git-SVN | 0:1.8.3.1-23.el7_8 |
Vulnerabilities 1
-
Medium 4.0
Malicious URLs can still cause Git to send a stored credential to the wrong server
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an expl…