CVE-2014-9390: 
Java vulnerability analysis and mitigation

CVE-2014-9390 affects multiple Git client versions (before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1) on Windows and OS X operating systems. The vulnerability was discovered by Matt Mackall and Augie Fackler of the Mercurial project and disclosed in December 2014. The issue affects Git clients, Mercurial before 3.2.3, Apple Xcode before 6.2 beta 3, libgit2 before 0.21.2, Egit, and JGit running on case-insensitive or case-normalizing filesystems (Git Blame Blog, GitHub Blog).

The vulnerability exists due to insufficient validation of repository paths on case-insensitive filesystems. An attacker can craft a malicious Git tree containing a .git/config file with different case variations (e.g., .Git/config or .gIt/config) or using ignorable Unicode codepoints. On case-insensitive filesystems like Windows NTFS and Mac OS X HFS+, these crafted paths can overwrite the legitimate .git/config file. The vulnerability received a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability allows remote Git servers to execute arbitrary commands on client machines through malicious repository trees. The impact is particularly severe as it can lead to complete system compromise when users clone, pull, or check out from a malicious repository (GitHub Blog, Rapid7).

Users should immediately update their Git clients to the patched versions: v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, or v2.2.1. Major Git libraries including libgit2 and JGit have released maintenance versions with fixes. GitHub for Windows and GitHub for Mac have also been updated to include the security fix. Additionally, GitHub has implemented server-side protection to block malicious trees (GitHub Blog, LibGit2).

The security community coordinated a simultaneous release of patches across multiple affected platforms and implementations. The vulnerability discovery highlighted the importance of case-sensitivity in filesystem security, leading to broader discussions about filesystem design and security implications (Git Blame Blog).