CVE-2020-11008 — Affected versions of Git have a vulnerability whereby Git can be tricked into se

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ cred

01What is this vulnerability?

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store…

02Affected products

Vendor	Product	Versions
git	git	< 2.17.5, >= 2.18.0, < 2.18.4, >= 2.19.0, 2.19.5, >= 2.20.0, < 2.20.4, >= 2.21.0, < 2.21.3, >= 2.22.0, < 2.22.4, >= 2.23.0, < 2.23.3, >= 2.24.0, < 2.24.3, >= 2.25.0, < 2.25.4, >= 2.26.0, < 2.26.2

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2020-04-21T18:40:13.000Z
• Last modified: 2024-08-04T11:21:14.528Z

09References

• github.com — https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7
• github.com — https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
• github.com — https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282
• security.gentoo.org — https://security.gentoo.org/glsa/202004-13
• lists.debian.org — https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html
• lists.fedoraproject.org — https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro…
• lists.fedoraproject.org — https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro…
• usn.ubuntu.com — https://usn.ubuntu.com/4334-1/
• lists.fedoraproject.org — https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro…
• lists.opensuse.org — http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• support.apple.com — https://support.apple.com/kb/HT211183
• seclists.org — http://seclists.org/fulldisclosure/2020/May/41