CVE-2020-5260: 
Git vulnerability analysis and mitigation

CVE-2020-5260 is a vulnerability in Git's credential helper system discovered by Felix Wilhelm of Google Project Zero and disclosed on April 14, 2020. The vulnerability affects Git versions up to 2.17.3, 2.18.2, 2.19.3, 2.20.2, 2.21.1, 2.22.2, 2.23.1, 2.24.1, 2.25.2, and 2.26.0. The issue allows malicious URLs containing encoded newlines to trick Git into sending stored credentials to the wrong server (GitHub Advisory).

The vulnerability exists in Git's credential helper protocol that is used to store and retrieve passwords from secure operating system storage. When processing URLs containing specially-crafted encoded newlines, the credential helper machinery could be fooled into injecting unintended values into the protocol stream. This would cause the credential helper to retrieve credentials for one server (e.g., good.example.com) when making an HTTP request to another server (e.g., evil.example.com), resulting in credentials being sent to the wrong destination. The vulnerability has a CVSS 3.1 base score of 9.3 CRITICAL (NVD).

An attacker could craft a URL that would cause Git to present stored credentials for any host to a host of the attacker's choosing. There are no restrictions on the relationship between the two hosts, making this a serious credential exposure vulnerability. While the malicious URLs would look suspicious, the attack vector is particularly concerning for automated systems that clone URLs not visible to users, such as Git submodules or package systems built around Git (GitHub Advisory).

The vulnerability was patched in Git versions 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, and 2.26.1 released on April 14, 2020. The fix prevents newline characters in credential protocol values. For users unable to upgrade immediately, workarounds include disabling credential helpers entirely or avoiding malicious URLs by examining hostnames and usernames for encoded newlines or evidence of credential protocol injections (GitHub Advisory).

The vulnerability was treated as a critical security issue, with major Linux distributions like Debian, Ubuntu, and Fedora quickly releasing security updates. Software projects using Git, such as Sourcetree, also released advisories and patches for their users (Sourcetree Advisory).