Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2014-9390

CriticalPublic exploit

JGit Improper Input Validation vulnerability

Published May 17, 2022 · Updated Aug 13, 2026 · Also known as DEBIAN-CVE-2014-9390, DLA-237-1, GHSA-6vvc-c2m3-cjf3, PYSEC-2020-217, UBUNTU-CVE-2014-9390, USN-2470-1

Key Facts

Patch immediately
  • CVE-2014-9390 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Xcode (Apple), Egit (Eclipse), Jgit (Eclipse) and 19 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 76% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Xcode <=6.1.1, dulwich 0.10.1-1, Egit 08-12-2014.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v4

9.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS (30-day exploit likelihood)

76%

Higher than 99.5% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2014-9390 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Affected Products

93 affected entries in total
ProductAffected versionsFixed in
XcodeApple6.2, 6.2-beta_26.1.1
EgitEclipseSee advisory08-12-2014
JgitEclipseSee advisory3.4.2
GitGit-ScmSee advisory1.8.5.6
Libgit2Libgit2See advisory0.21.3
17 more affected products in the full CVE brief

Patched Releases

Xcode

<=6.1.1

dulwich

0.10.1-1

Egit

08-12-2014

Jgit

3.4.2, 3.7.0-1

Git

1:1.9.1-1ubuntu0.1, 1:2.1.4-1, 2.11.0-1.1, 2.43.7-1.ph5, NA, 1.8.5.6

git-arch

2.11.0-1.1

git-core

2.11.0-1.1

git-credential-gnome-keyring

2.11.0-1.1

git-cvs

2.11.0-1.1

git-daemon

2.11.0-1.1

git-doc

2.11.0-1.1

git-email

2.11.0-1.1

git-extras

2.43.7-1.ph5, NA

git-gui

2.11.0-1.1

git-lang

2.43.7-1.ph5, NA

git-svn

2.11.0-1.1

git-web

2.11.0-1.1

gitk

2.11.0-1.1

Libgit2

0.21.3-1, 0.21.3

Mercurial

1.6.4-1+deb6u1, 2.8.2-1ubuntu1.3, 3.1.2-2, 3.2.3

org.eclipse.jgit:org.eclipse.jgit

3.5.3

rootio-git

1:2.1.4-1, 1:2.1.4-2

Timeline

  1. Publicly disclosed

    May 17, 2022

  2. Last updated

    Aug 13, 2026

Weakness Type

  • CWE-20 Improper Input Validation
  • CWE-172 Encoding Error
  • CWE-178 Improper Handling of Case Sensitivity
  • CWE-552 Files or Directories Accessible to External Parties
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2014-9390 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo