{"id":"PYSEC-2020-217","details":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","aliases":["CVE-2014-9390","GHSA-6vvc-c2m3-cjf3"],"modified":"2026-06-10T17:01:24.065182218Z","published":"2020-02-12T02:15:00Z","references":[{"type":"WEB","url":"https://news.ycombinator.com/item?id=8769667"},{"type":"ARTICLE","url":"http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html"},{"type":"ARTICLE","url":"https://github.com/blog/1938-git-client-vulnerability-announced"},{"type":"WEB","url":"http://securitytracker.com/id?1031404"},{"type":"WEB","url":"http://article.gmane.org/gmane.linux.kernel/1853266"},{"type":"WEB","url":"http://mercurial.selenic.com/wiki/WhatsNew"},{"type":"WEB","url":"http://support.apple.com/kb/HT204147"},{"type":"WEB","url":"https://libgit2.org/security/"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6vvc-c2m3-cjf3"}],"affected":[{"package":{"name":"mercurial","ecosystem":"PyPI","purl":"pkg:pypi/mercurial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/mercurial/PYSEC-2020-217.yaml"}}],"schema_version":"1.7.5"}