Summary
Felix Wilhelm discovered that Git incorrectly handled certain URLs that
included newlines. A remote attacker could possibly use this issue to trick
Git into returning credential information for a wrong host.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | git | 1:2.7.4-0ubuntu1.8 |
| Ubuntu · 18.04 LTS 18.04:LTS | git | 1:2.17.1-1ubuntu0.6 |
Vulnerabilities 1
-
Critical 9.3
malicious URLs may cause Git to present stored credentials to the wrong server
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure stor…
References
-
report
https://ubuntu.com/security/CVE-2020-5260