CVE-2020-11008

Summary

CVE	CVE-2020-11008
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-04-21 19:15:00 UTC
Updated	2023-11-07 03:14:00 UTC
Description	Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

Risk And Classification

Problem Types: CWE-522

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	19.10	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	19.10	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Application	Git-scm	Git	All	All	All	All
Application	Git-scm	Git	All	All	All	All

References

Reference	Source	Link	Tags
[SECURITY] [DLA 2182-1] git security update	MLIST	lists.debian.org	Mailing List, Third Party Advisory
Full Disclosure: APPLE-SA-2020-05-20-1 Xcode 11.5	FULLDISC	seclists.org
[SECURITY] Fedora 32 Update: git-2.26.2-1.fc32 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
[SECURITY] Fedora 30 Update: git-2.21.3-1.fc30 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
USN-4334-1: Git vulnerability \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
[security-announce] openSUSE-SU-2020:0598-1: moderate: Security update f	SUSE	lists.opensuse.org
[SECURITY] Fedora 31 Update: git-2.25.4-1.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 31 Update: git-2.25.4-1.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
Git: Information disclosure (GLSA 202004-13) — Gentoo security	GENTOO	security.gentoo.org	Third Party Advisory
[SECURITY] Fedora 32 Update: git-2.26.2-1.fc32 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 30 Update: git-2.21.3-1.fc30 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Malicious URLs can still cause Git to send a stored credential to the wrong server · Advisory · git/git · GitHub	CONFIRM	github.com	Patch, Third Party Advisory
credential: treat URL without scheme as invalid · git/git@c44088e · GitHub	MISC	github.com	Patch, Third Party Advisory
About the security content of Xcode 11.5 - Apple Support	CONFIRM	support.apple.com
malicious URLs may cause Git to present stored credentials to the wrong server · Advisory · git/git · GitHub	MISC	github.com	Mitigation, Patch, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

296073 Oracle Solaris 11.4 Support Repository Update (SRU) 24.75.2 Missing (CPUJUL2020)
352295 Amazon Linux Security Update for git: AL2012-2021-337
376916 Alibaba Cloud Linux Security Update for git (ALINUX2-SA-2020:0094)
377091 Alibaba Cloud Linux Security Update for git (ALINUX3-SA-2022:0109)
500221 Alpine Linux Security Update for git
503965 Alpine Linux Security Update for git
670767 EulerOS Security Update for git (EulerOS-SA-2021-2525)
670791 EulerOS Security Update for git (EulerOS-SA-2021-2549)
670886 EulerOS Security Update for git (EulerOS-SA-2021-1068)
690665 Free Berkeley Software Distribution (FreeBSD) Security Update for malicious urls can cause git to send a stored credential to wrong server (67765237-8470-11ea-a283-b42e99a1b9c3)