==========================================================================
Ubuntu Security Notice USN-4334-1
April 21, 2020

git vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Git could be made to expose sensitive information.

Software Description:
– git: fast, scalable, distributed revision control system

Details:

Carlo Arenas discovered that Git incorrectly handled certain URLs
containing newlines, empty hosts, or lacking a scheme. A remote attacker
could possibly use this issue to trick Git into returning credential
information for a wrong host.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
git 1:2.20.1-2ubuntu1.19.10.3

Ubuntu 18.04 LTS:
git 1:2.17.1-1ubuntu0.7

Ubuntu 16.04 LTS:
git 1:2.7.4-0ubuntu1.9

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4334-1
CVE-2020-11008

Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.20.1-2ubuntu1.19.10.3
https://launchpad.net/ubuntu/+source/git/1:2.17.1-1ubuntu0.7
https://launchpad.net/ubuntu/+source/git/1:2.7.4-0ubuntu1.9

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl6e7cQACgkQZWnYVadE
vpObRA//ZgvhtlrttLEumLqyNDsQRcWOa8E16Hs5/uUi1LZ6m6MopQm73vD+5h7w
Gy5RlCcqboXa9mC7utG0+OpEcTCYx5FFUfAXSoFrR5Ha8V36rEqEFmYWvkMqDr9N
qrRWlXwvUh1Fa8kt+bUKyWNDZ2/VnrBeujgc6YZ09Bc6kt5qwLJFhJFxteY3fx6j
A8XRqE6+N5L1xj/sdVdbj+wQ0rst68Yk4NVWITZQ/TUzkE6QOrXMUNvqcYMDoYqh
SHf3vvadqMKB7FyxwCNo4F+Eb7IYNlD0dEvdky5pk/kXR83ZTy/+hRy72+7yQPW7
3Dk9xQ9neBGR2R4z4YvlzcOBTeI5QWaEzKDi+a9LjKFFlpylslhscnshnIyHANA+
YIAIVUiMi/W9aGbZgookS2C2FHV04aDWSFj/2MuwQXgpa3ABNAlD+QGOE3p87eqD
89QA1fdGOwgiR4kCi9fkCgFsMkg8k3bkkP1odzIT3iW458EiJCcDaxSuACQxcdK8
gd52dK6b2ZKQDBqTi07nT1Cygy+U1ZGfi+dPY/jtiZ888eRJwoTpx0NcvTYV4Ziy
90JJThGvYFzdycSaAItbIt3LCZXsjajmWGCflpE2vpcxEeZ0XoaWqGwZeO3lA+kb
j4OfitKWSfpSMBZi8rSj62k++4n0jFL1hEQ9qZytV9EOrOKG9j8=
=DI+u
—–END PGP SIGNATURE—–
—