CVE-2020-5260 in the critical feed json
malicious URLs may cause Git to present stored credentials to the wrong server
published 6y ago modified last mo. also BIT-git-2020-5260 , EUVD-2020-26465 , GHSA-qm7j-c969-7j4q
- cvss
- 9.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.9%
- EPSS 14.9% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
Patch / fix
- bitnami git 2.17.4, 2.22.3
- git git 2.17.4, 2.22.3
- git-scm git 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.23.2, 2.24.2, 2.25.3, 2.26.1
- git Debian 14, Debian 13, Debian 12 1:2.26.1-1
debian advisories DEBIAN-CVE-2020-5260
- git Ubuntu 16.04 LTS 1:2.7.4-0ubuntu1.8
- git Ubuntu 18.04 LTS 1:2.17.1-1ubuntu0.6
ubuntu advisories UBUNTU-CVE-2020-5260
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- git RHEL 8 2.18.2-2.el8_1
- gitk RHEL 8 2.18.2-2.el8_1
- gitweb RHEL 8 2.18.2-2.el8_1
- git-all RHEL 8 2.18.2-2.el8_1
- git-gui RHEL 8 2.18.2-2.el8_1
- git-svn RHEL 8 2.18.2-2.el8_1
- git-core RHEL 8 2.18.2-2.el8_1
- perl-Git RHEL 8 2.18.2-2.el8_1
red hat advisories RHSA-2020:3581RHSA-2020:1513RHSA-2020:1503RHSA-2020:1518RHSA-2020:1511
- git SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +16 more 2.26.2-27.36.1
- git SLE Module for Development Tools 15 SP1, SLE Module for Basesystem 15 SP1 2.26.1-3.25.2
- git SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +16 more 2.26.0-27.27.1
- pcre2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +16 more 10.34-1.3.1
- perl-CGI SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +14 more 4.38-1.3.1
- git SLES for SAP 15, SLES 15-LTSS, SLE Module for Development Tools 15 SP1 +3 more 2.16.4-3.20.1
suse advisories SUSE-SU-2020:1295-1SUSE-SU-2020:1121-1SUSE-SU-2020:0992-1SUSE-SU-2020:0991-1
- git openSUSE Tumbleweed 2.33.0-1.3
- git openSUSE Leap 15.1 2.26.1-lp151.4.9.1
- git openSUSE Leap 15.1 2.16.4-lp151.4.6.1
opensuse advisories openSUSE-SU-2024:10786-1openSUSE-SU-2020:0598-1openSUSE-SU-2020:0524-1
- git Alpine 3.10 2.22.3-r0
- git Alpine 3.11 2.24.2-r0
- git Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 2.26.1-r0
- git Alpine 3.8 2.18.3-r0
- git Alpine 3.9 2.20.3-r0
alpine advisories ALPINE-CVE-2020-5260
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- git Arch Linux 2.26.1-1
arch linux advisories AVG-1133
Is CVE-2020-5260 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-5260 updated cvss 7.5
git: Crafted URL containing new lines can cause credential leak
-
Red Hat Enterprise Linux AppStream (v. 8) git 2.18.2-2.el8_1, gitk 2.18.2-2.el8_1, gitweb 2.18.2-2.el8_1, git-all 2.18.2-2.el8_1, git-gui 2.18.2-2.el8_1, git-svn 2.18.2-2.el8_1, +7 morefixed: vendor fix RHSA-2020:1513
-
Red Hat Enterprise Linux AppStream E4S (v. 8.0) git 2.18.2-2.el8_0, gitk 2.18.2-2.el8_0, gitweb 2.18.2-2.el8_0, git-all 2.18.2-2.el8_0, git-gui 2.18.2-2.el8_0, git-svn 2.18.2-2.el8_0, +7 morefixed: vendor fix RHSA-2020:1518
-
Red Hat Enterprise Linux Client Optional (v. 7) git 1.8.3.1-22.el7_8, gitk 1.8.3.1-22.el7_8, git-hg 1.8.3.1-22.el7_8, git-p4 1.8.3.1-22.el7_8, gitweb 1.8.3.1-22.el7_8, git-all 1.8.3.1-22.el7_8, +12 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) git 1.8.3.1-22.el7_8, gitk 1.8.3.1-22.el7_8, git-hg 1.8.3.1-22.el7_8, git-p4 1.8.3.1-22.el7_8, gitweb 1.8.3.1-22.el7_8, git-all 1.8.3.1-22.el7_8, +12 morefixed: vendor fix RHSA-2020:1511
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) git 1.8.3.1-23.el7_7, gitk 1.8.3.1-23.el7_7, git-hg 1.8.3.1-23.el7_7, git-p4 1.8.3.1-23.el7_7, gitweb 1.8.3.1-23.el7_7, git-all 1.8.3.1-23.el7_7, +12 morefixed: vendor fix RHSA-2020:3581
-
Red Hat Enterprise Linux Server (v. 7) git 1.8.3.1-22.el7_8, perl-Git 1.8.3.1-22.el7_8fixed: vendor fix RHSA-2020:1511
-
Red Hat Enterprise Linux Server EUS (v. 7.7) git 1.8.3.1-23.el7_7, perl-Git 1.8.3.1-23.el7_7fixed: vendor fix RHSA-2020:3581
-
Red Hat Enterprise Linux Server Optional (v. 7) gitk 1.8.3.1-22.el7_8, git-hg 1.8.3.1-22.el7_8, git-p4 1.8.3.1-22.el7_8, gitweb 1.8.3.1-22.el7_8, git-all 1.8.3.1-22.el7_8, git-bzr 1.8.3.1-22.el7_8, +10 morefixed: vendor fix RHSA-2020:1511
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) gitk 1.8.3.1-23.el7_7, git-hg 1.8.3.1-23.el7_7, git-p4 1.8.3.1-23.el7_7, gitweb 1.8.3.1-23.el7_7, git-all 1.8.3.1-23.el7_7, git-bzr 1.8.3.1-23.el7_7, +10 morefixed: vendor fix RHSA-2020:3581
show 3 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 7) git 1.8.3.1-22.el7_8, perl-Git 1.8.3.1-22.el7_8 Red Hat Enterprise Linux Workstation Optional (v. 7) gitk 1.8.3.1-22.el7_8, git-hg 1.8.3.1-22.el7_8, git-p4 1.8.3.1-22.el7_8, gitweb 1.8.3.1-22.el7_8, git-all 1.8.3.1-22.el7_8, git-bzr 1.8.3.1-22.el7_8, +10 morefixed: vendor fix RHSA-2020:1511
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-git218-git 2.18.2-3.el7, rh-git218-gitk 2.18.2-3.el7, rh-git218-git-p4 2.18.2-3.el7, rh-git218-gitweb 2.18.2-3.el7, rh-git218-git-all 2.18.2-3.el7, rh-git218-git-cvs 2.18.2-3.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-git218-git 2.18.2-3.el7, rh-git218-gitk 2.18.2-3.el7, rh-git218-git-p4 2.18.2-3.el7, rh-git218-gitweb 2.18.2-3.el7, rh-git218-git-all 2.18.2-3.el7, rh-git218-git-cvs 2.18.2-3.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-git218-git 2.18.2-3.el7, rh-git218-gitk 2.18.2-3.el7, rh-git218-git-p4 2.18.2-3.el7, rh-git218-gitweb 2.18.2-3.el7, rh-git218-git-all 2.18.2-3.el7, rh-git218-git-cvs 2.18.2-3.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-git218-git 2.18.2-3.el7, rh-git218-gitk 2.18.2-3.el7, rh-git218-git-p4 2.18.2-3.el7, rh-git218-gitweb 2.18.2-3.el7, rh-git218-git-all 2.18.2-3.el7, rh-git218-git-cvs 2.18.2-3.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-git218-git 2.18.2-3.el7, rh-git218-gitk 2.18.2-3.el7, rh-git218-git-p4 2.18.2-3.el7, rh-git218-gitweb 2.18.2-3.el7, rh-git218-git-all 2.18.2-3.el7, rh-git218-git-cvs 2.18.2-3.el7, +9 morefixed: vendor fix RHSA-2020:1503
-
Red Hat Enterprise Linux 6 git, gitk, gitweb, git-all, git-cvs, git-gui, +6 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
14.89% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | git | <2.17.4 >=2.22.0, <2.22.3 |
2.17.4 2.22.3 |
Affected products
- git git
Classification
References
-
github.com
/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b
patch, third-party-advisory, advisory
-
github.com
/git/git/security/advisories/GHSA-qm7j-c969-7j4q
mitigation, patch, third-party-advisory, advisory
-
debian.org
/security/2020/dsa-4657
vendor-advisory, third-party-advisory, advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-04/msg00027.html
vendor-advisory, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/
vendor-advisory, web
-
security.gentoo.org
/glsa/202004-13
vendor-advisory, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/
vendor-advisory, web
-
usn.ubuntu.com
/4329-1/
vendor-advisory, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2020-05/msg00003.html
vendor-advisory, third-party-advisory, advisory
-
lore.kernel.org
/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/
web
-
lists.debian.org
/debian-lts-announce/2020/04/msg00010.html
mailing-list, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2020/04/15/5
mailing-list, discussion
-
packetstormsecurity.com
/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html
third-party-advisory, vdb-entry, advisory
-
openwall.com
/lists/oss-security/2020/04/15/6
mailing-list, third-party-advisory, advisory
-
support.apple.com
/kb/HT211141
third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2020/04/20/1
mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5260
web
Sources
- CVE List CVE-2020-5260
- NVD CVE-2020-5260
- OSV BIT-git-2020-5260
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.