| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jgit:org.eclipse.jgit | < 3.5.3 | 3.5.3 |
| mercurial | < 3.2.3 | 3.2.3 |
| xcode | = 6.2≤ 6.1.1 | |
| egit | < 08-12-2014 | 08-12-2014 |
| jgit | ≥ 3.5.0, < 3.5.3< 3.4.2 | 3.5.33.4.2 |
| git | ≥ 1.9.0, < 1.9.5≥ 2.0.0, < 2.0.5≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1< 1.8.5.6 | 1.9.52.0.52.1.42.2.11.8.5.6 |
| libgit2 | < 0.21.3 | 0.21.3 |
| mercurial | < 3.2.3 | 3.2.3 |
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free