---
title: "GitLab not affected by Git vulnerability CVE-2014-9390"
date: 2014-12-19
categories: company
author: Patricio Cano
---

A critical Git security [vulnerability](http://article.gmane.org/gmane.linux.kernel/1853266) was announced yesterday, that
affects all versions of the official Git client. Since this is a client-side only vulnerability, **GitLab.com**, **GitLab
Community Edition** and **GitLab Enterprise Edition** are not directly affected.

The vulnerability is present on Git and Git-compatible clients that access Git repositories from a case-insensitive or
case-normalizing filesystem. An attacker can create a malicious Git tree that will cause the `.git/config` directory to be
overwritten when cloning or checking out a repository. This enables the attacker to execute arbitrary commands in the
client's machine. Git clients running on macOS (HFS+ if not formatted as case-sensitive) or any version of Microsoft
Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients running in a case-sensitive filesystem
are not affected.

We **strongly** recommend our users to update their Git clients as soon as possible and to be cautious when cloning repositories
from untrusted sources.

The following updated versions of Git address this vulnerability:

- The Git core team has announced [maintenance releases](https://www.kernel.org/pub/software/scm/git/) for all current
versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).

- These major Git libraries, [libgit2](https://github.com/libgit2/libgit2/) and [JGit](https://eclipse.org/jgit/),
have released maintenance versions with the fix as well.

Please contact us at support@gitlab.com if you have any questions about this issue.

## About GitLab

You can try GitLab by [downloading](/install/) the Community Edition and installing it on your
own server or by signing up to our free, unlimited GitLab instance [GitLab.com](https://gitlab.com/users/sign_up).

Check out [GitLab Enterprise Edition](/features/#enterprise) for deep LDAP integration, git hooks,
Jenkins integration and many more powerful enterprise features.