{"id":"CVE-2020-5260","details":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.","aliases":["BIT-git-2020-5260","GHSA-qm7j-c969-7j4q"],"modified":"2026-10-24T13:50:53.404603746Z","published":"2020-04-14T23:15:12.607Z","related":["SUSE-SU-2020:0991-1","SUSE-SU-2020:0992-1","SUSE-SU-2020:1121-1","SUSE-SU-2020:1295-1","openSUSE-SU-2020:0524-1","openSUSE-SU-2020:0598-1","openSUSE-SU-2024:10786-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"CPE_RANGE","range":[{"introduced":"2.18.0"},{"fixed":"2.18.3"},{"introduced":"2.19.0"},{"fixed":"2.19.4"},{"introduced":"2.20.0"},{"fixed":"2.20.3"},{"introduced":"2.21.0"},{"fixed":"2.21.2"},{"introduced":"2.23.0"},{"fixed":"2.23.2"},{"introduced":"2.24.0"},{"fixed":"2.24.2"},{"introduced":"2.25.0"},{"fixed":"2.25.3"}]}],"vendor_product":"git-scm:git","cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"]},{"vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"19.10"},{"last_affected":"19.10"}],"source":"CPE_STRING"}]},{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING"}],"vendor_product":"debian:debian_linux"},{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"30"},{"last_affected":"30"},{"introduced":"31"},{"last_affected":"31"},{"introduced":"32"},{"last_affected":"32"}]}]},{"vendor_product":"opensuse:leap","cpes":["cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"15.1"},{"last_affected":"15.1"}]}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/"},{"type":"WEB","url":"https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2020/04/15/6"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2020/04/20/1"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202004-13"},{"type":"ADVISORY","url":"https://support.apple.com/kb/HT211141"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4329-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4657"},{"type":"FIX","url":"https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b"},{"type":"FIX","url":"https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2020/04/15/5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/git-for-windows/git","events":[{"introduced":"9c98e1ccdfd839e4eaae1c2747d0088ef89d446b"},{"fixed":"14af9f9d205f4a6a033c7b6f48980d1eeee2c610"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","range":[{"introduced":"2.26.0"},{"fixed":"2.26.1"}],"source":"CPE_RANGE"}]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5260.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/git/git","events":[{"introduced":"0"},{"fixed":"c42c0f12972194564f039dcf580d89ca14ae72d6"},{"introduced":"b697d92f56511e804b8ba20ccbe7bdc85dc66810"},{"fixed":"69fab82147e74a51ee1144a336eb47c7297b9b78"},{"introduced":"53f9a3e157dbbc901a02ac2c73346d375e24978c"},{"fixed":"21a3e5016bb218dc9b016284c88ba685bc446b70"},{"introduced":"1d4361b0f344188ab5eec6dcea01f61a3a3a1670"},{"fixed":"a5979d7009017c79b0100b7b66e8567b3ad7b022"},{"introduced":"5d826e972970a784bd7a7bdf587512510097b8c7"},{"fixed":"d1259ce117d0714f1441956805612fb36d7ce7f8"},{"introduced":"8104ec994ea3849a968b4667d072fedd1e688642"},{"fixed":"fe2268649423eba889e942293e9c98c781277bf2"},{"introduced":"5fa0f5238b0cd46cfe7f6fa76c3f526ea98148d9"},{"fixed":"17a02783d8f7cac1780d8035f3e2e0d25bba077b"},{"introduced":"da72936f544fec5a335e66432610e4cef4430991"},{"fixed":"506223f9c5c8956f895f0342e4a6d4244b5fa570"},{"introduced":"d0654dc308b0ba76dd8ed7bbb33c8d8f7aacd783"},{"fixed":"67b0a24910fbb23c8f5e7a2c61c339818bc68296"},{"introduced":"274b9cc25322d9ee79aa8e6d4e86f0ffe5ced925"},{"fixed":"de49261b050d9cd8ec73842356077bc5b606640f"},{"fixed":"9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"2.17.4"}],"source":"CPE_RANGE"},{"range":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"2.18.0"},{"fixed":"2.18.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"2.19.0"},{"fixed":"2.19.4"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"2.20.0"},{"fixed":"2.20.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"2.21.0"},{"fixed":"2.21.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","range":[{"introduced":"2.23.0"},{"fixed":"2.23.2"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","range":[{"introduced":"2.24.0"},{"fixed":"2.24.2"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","range":[{"introduced":"2.25.0"},{"fixed":"2.25.3"}]},{"range":[{"introduced":"2.26.0"},{"fixed":"2.26.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"},{"range":[{"fixed":"9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v2.26.0","v2.25.0","v2.24.0","v2.25.2","v2.25.1","v2.23.1","v2.22.2","v2.21.1","v2.20.2","v2.19.3","v2.18.2","v2.17.3","v2.24.1","v2.22.1","v2.22.0","v2.23.0","v2.21.0","v2.20.1","v2.19.2","v2.18.1","v2.17.2","v2.20.0","v2.15.0","v2.17.0","v2.18.0","v2.19.1","v2.19.0","v2.17.1","v2.17.0-rc2","v2.17.0-rc1","v2.17.0-rc0","v2.16.0-rc0","v2.16.0","v2.16.0-rc1","v2.16.0-rc2","v2.15.0-rc2","v2.15.0-rc1","v2.15.0-rc0","v2.14.0","v2.14.0-rc1","v2.11.0","v2.12.0","v2.13.0","v2.14.0-rc0","v2.13.0-rc2","v2.13.0-rc1","v2.13.0-rc0","v2.10.0","v2.12.0-rc2","v2.12.0-rc1","v2.12.0-rc0","v2.11.0-rc3","v2.9.0","v2.11.0-rc2","v2.11.0-rc1","v2.11.0-rc0","v2.10.0-rc2","v2.10.0-rc1","v2.10.0-rc0","v2.7.0","v2.9.0-rc2","v2.8.0","v2.9.0-rc1","v2.9.0-rc0","v2.8.0-rc4","v2.8.0-rc1","v2.8.0-rc3","v2.8.0-rc2","v2.8.0-rc0","v2.6.0","v2.7.0-rc3","v2.4.0","v2.7.0-rc1","v2.7.0-rc2","v2.0.0","v2.7.0-rc0","v2.6.0-rc1","v2.6.0-rc3","v2.6.0-rc2","v2.5.0","v2.6.0-rc0","v2.2.0","v2.5.0-rc3","v2.5.0-rc0","v2.5.0-rc2","v2.5.0-rc1","v2.4.0-rc0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","v2.3.0-rc0","v1.8.5","v2.2.0-rc1","v2.2.0-rc3","v2.2.0-rc2","v2.1.0","v2.2.0-rc0","v2.1.0-rc2","v2.1.0-rc1","v2.1.0-rc0","v1.9.0","v2.0.0-rc2","v2.0.0-rc4","v2.0.0-rc3","v2.0.0-rc1","v2.0.0-rc0","v1.9-rc0","v1.9.0-rc3","v1.9-rc2","v1.9-rc1","v1.8.5-rc3","v1.8.5-rc2","v1.8.5-rc0","v1.8.5-rc1","v1.8.4","v1.8.3","v1.8.4-rc4","v1.8.4-rc3","v1.8.4-rc2","v1.8.4-rc1","v1.8.4-rc0","v1.8.2","v1.8.1","v1.7.11","v1.8.3-rc0","v1.8.3-rc3","v1.8.3-rc2","v1.8.3-rc1","v1.8.2-rc3","v1.8.2-rc2","v1.8.2-rc1","v1.8.2-rc0","v1.8.0","v1.8.1-rc2","v1.8.1-rc3","v1.7.12","v1.7.9","v1.8.1-rc1","v1.8.1-rc0","v1.8.0-rc3","v1.8.0-rc2","v1.8.0-rc1","v1.8.0-rc0","v1.7.3","v1.7.12-rc3","v1.7.12-rc2","v1.7.11-rc1","v1.7.12-rc1","v1.7.12-rc0","v1.7.11-rc3","v1.7.11-rc0","v1.7.11-rc2","v1.7.10","v1.7.8","v1.7.10-rc3","v1.7.10-rc4","v1.7.10-rc2","v1.7.10-rc1","v1.7.10-rc0","v1.7.7","v1.7.9-rc2","v1.7.9-rc1","v1.7.9-rc0","v1.7.4","v1.7.5","v1.7.8-rc2","v1.7.8-rc4","v1.7.8-rc3","v1.7.0","v1.7.8-rc1","v1.7.6","v1.7.8-rc0","v1.7.7-rc1","v1.7.7-rc3","v1.7.7-rc2","v1.7.7-rc0","v1.6.0","v1.7.6-rc3","v1.7.6-rc2","v1.7.2-rc1","v1.7.6-rc1","v1.7.6-rc0","v1.6.6","v1.7.5-rc3","v1.7.5-rc2","v1.7.5-rc1","v1.7.5-rc0","v1.7.4-rc1","v1.7.4-rc3","v1.7.4-rc2","v1.7.4-rc0","v1.7.1","v1.7.3.1","v1.7.3-rc2","v1.7.3-rc1","v1.7.3-rc0","v1.7.2","v1.7.2-rc3","v1.7.2-rc2","v1.7.2-rc0","v1.7.1-rc2","v1.7.1-rc1","v1.7.1-rc0","v1.7.0-rc2","v1.6.3","v1.6.5","v1.7.0-rc1","v1.7.0-rc0","v1.6.6-rc1","v1.6.1-rc1","v1.6.6-rc4","v1.6.6-rc3","v1.6.6-rc2","v1.6.6-rc0","v1.6.5-rc3","v1.6.5-rc2","v1.6.5-rc1","v1.6.5-rc0","v1.6.4","v1.6.4-rc3","v1.6.4-rc2","v1.6.4-rc1","v1.6.4-rc0","v1.6.2","v1.6.3-rc4","v1.6.3-rc3","v1.6.3-rc2","v1.6.3-rc1","v1.6.3-rc0","v1.6.1","v1.6.2-rc2","v1.6.2-rc1","v1.6.2-rc0","v1.6.1-rc4","v1.6.1-rc3","v1.6.1-rc2","v1.6.0-rc3","v1.6.0-rc2","v1.6.0-rc1","v1.6.0-rc0","v1.5.6","v1.5.6-rc3","v1.5.6-rc2","v1.5.6-rc1","v1.5.6-rc0","v1.5.5","v1.5.5-rc3","v1.5.5-rc2","v1.5.5-rc1","v1.5.5-rc0","v1.5.4","v1.5.4-rc5","v1.5.4-rc4","v1.5.4-rc3","v1.5.4-rc2","v1.5.4-rc1","v1.5.4-rc0","v1.5.3.1","v1.5.3","v1.5.3-rc7","v1.5.3-rc6","v1.5.3-rc5","v1.5.3-rc4","v1.5.3-rc3","v1.5.3-rc2","v1.5.3-rc1","v1.5.3-rc0","v1.5.2","v1.5.2-rc3","v1.5.2-rc2","v1.5.2-rc1","v1.5.2-rc0","v1.5.1","v1.5.1-rc3","v1.5.1-rc2","v1.5.1-rc1","v1.5.0","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","v1.4.4.1","v1.4.4","v1.4.4-rc2","v1.4.4-rc1","v1.4.3","v1.4.3-rc3","v1.4.3-rc2","v1.4.3-rc1","v1.4.2","v1.4.2-rc4","v1.4.2-rc3","v1.4.2-rc2","v1.4.2-rc1","v1.4.1","v1.4.1-rc2","v1.4.1-rc1","v1.3.0-rc1","v1.2.0","v1.1.0","v1.0.0","v1.0rc6","v0.99.9n","v1.0rc5","v0.99.9m","v1.0rc4","v0.99.9l","v0.99.9k","v1.0rc3","v0.99.9j","v1.0rc2","v0.99.9i","v1.0rc1","v0.99.9h","v0.99.9g","v0.99.9f","v0.99.9e","v0.99.9d","v0.99.9c","v0.99.9b","v0.99.9a","v0.99.8g","v0.99.8f","v0.99.8e","v0.99.8d","v0.99.8c","v0.99.8b","v0.99.8a","v0.99.8","v0.99.7","v0.99.6","v0.99.5","v0.99.4","v0.99.3","v0.99.2","v0.99.1","v0.99"],"database_specific":{"vanir_signatures_modified":"2026-10-24T13:50:53Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5260.json","vanir_signatures":[{"source":"https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","target":{"file":"credential.c","function":"credential_write_item"},"deprecated":false,"digest":{"function_hash":"218640991234414386030386745330935894343","length":160},"id":"CVE-2020-5260-19ebbcc1","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","target":{"file":"credential.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226140449435715379469066322103220397676","179800638862221697882631149461640636152","91329431276767822341099473480816583347","228261265764274780220503902672417309942"]},"id":"CVE-2020-5260-acb7f864"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}