Description
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | git +11 | 1.7.1-3.el6_4.1 | RHSA-2013:0589 |
Advisories 1
- RHSA-2013:0589 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 1028205 vdb-entry
- RHSA-2013:0589 vendor-advisory
- https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt
- http://support.apple.com/kb/HT5937
- git-gitimapsend-spoofing(82329) vdb-entry
- APPLE-SA-2013-09-18-3 vendor-advisory
- 52361 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586
- [ANNOUNCE] 20130220 Git v1.8.1.4 mailing-list
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- openSUSE-SU-2013:0380 vendor-advisory
- 58148 vdb-entry
- 52443 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=909977
- https://bugzilla.novell.com/show_bug.cgi?id=804730
- openSUSE-SU-2013:0382 vendor-advisory
- 52467 third-party-advisory