==========================================================================
Ubuntu Security Notice USN-4329-1
April 14, 2020

git vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Git could be made to expose sensitive information.

Software Description:
– git: fast, scalable, distributed revision control system

Details:

Felix Wilhelm discovered that Git incorrectly handled certain URLs that
included newlines. A remote attacker could possibly use this issue to trick
Git into returning credential information for a wrong host.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
git 1:2.20.1-2ubuntu1.19.10.2

Ubuntu 18.04 LTS:
git 1:2.17.1-1ubuntu0.6

Ubuntu 16.04 LTS:
git 1:2.7.4-0ubuntu1.8

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4329-1
CVE-2020-5260

Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.20.1-2ubuntu1.19.10.2
https://launchpad.net/ubuntu/+source/git/1:2.17.1-1ubuntu0.6
https://launchpad.net/ubuntu/+source/git/1:2.7.4-0ubuntu1.8

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl6WRx4ACgkQZWnYVadE
vpNuJRAArSLMrTitPA6vGuOyQI27WrF40lfBEEw/gpkGzCuqk+eaTQVHMGjMVYMa
zzVtEpJP1tOwXlfe4ZJwFTGb4MPwe0srvoLzivLvuGErWwbfldkTifaodKy0ThuS
HdiWw27o3v+t+c8epUZuUdnWAxy6LlG9a+FoRR927mqCShwewA3esAiUL7Dc5LX1
Ag8Yndy10xPmsbnHTFv5Y2HyQPWtM34X5wep2n043YhGPgpOi7NXgsGax48ofEIv
J8+5yNNCiv3EtIbZaAorMlu5VBi4bzQ8jpb/tzCNrj2TPuI43xV3eTor9HySvAab
WY7+z/P7CyQcBoXcS8gDscICIqtHK45VrU7mjFU7Sm/3Wf5ZYO31qcwIt0SiTzZl
4Bf5CkJ3Xz3JKmVn2NpLjBjszJaOgKgBtQq3Tpptqo8f/pxXNGvFkTNL1wCtenAI
vqrHnc62WaF6j9XEkR+5eaoJqTL0Tt27nLRPWXM3l5ElyDGod3kmfBc0cEy9M9HA
Qmm9VhCmecARzcZ48e7tpACCbgCETyWn15CkQJeDkvK9bsVIHXckFVgc0qu0On/e
y6O7zscSZjGdwvoN2/ho6SkjhxLY9NlB+t9Z4VVcRnTVO/1NHVBDSfWZADg1jwvR
+7GTl+F3eEjERCpCkyjcL3Tn00dMeYy5lm7LkpYKu50y2A+q5HQ=
=BTeN
—–END PGP SIGNATURE—–
—