Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
82 vulnerabilities by git
CVE-2026-114469 (GCVE-0-2026-114469)
Vulnerability from nvd – Published: 2026-11-12 13:12 – Updated: 2026-11-12 13:12
VLAI
EPSS
VEX
Title
Out-of-bounds Read in Git
Summary
Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size
Severity
4.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:12:55.269Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/811"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Out-of-bounds Read in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-114469",
"datePublished": "2026-11-12T13:12:55.269Z",
"dateReserved": "2026-10-21T15:02:55.490Z",
"dateUpdated": "2026-11-12T13:12:55.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114467 (GCVE-0-2026-114467)
Vulnerability from nvd – Published: 2026-11-12 13:13 – Updated: 2026-11-12 13:13
VLAI
EPSS
VEX
Title
Out-of-bounds Write in Git
Summary
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:13:05.067Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/810"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Out-of-bounds Write in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-114467",
"datePublished": "2026-11-12T13:13:05.067Z",
"dateReserved": "2026-10-21T15:02:50.482Z",
"dateUpdated": "2026-11-12T13:13:05.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114466 (GCVE-0-2026-114466)
Vulnerability from nvd – Published: 2026-11-12 13:13 – Updated: 2026-11-12 13:13
VLAI
EPSS
VEX
Title
Insufficient Granularity of Access Control in Git
Summary
Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe
Severity
4.4 (Medium)
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:13:00.071Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/812"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Insufficient Granularity of Access Control in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-114466",
"datePublished": "2026-11-12T13:13:00.071Z",
"dateReserved": "2026-10-21T15:02:45.478Z",
"dateUpdated": "2026-11-12T13:13:00.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113408 (GCVE-0-2026-113408)
Vulnerability from nvd – Published: 2026-11-12 07:09 – Updated: 2026-11-12 07:09
VLAI
EPSS
VEX
Title
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git
Summary
Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T07:09:19.100Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/809"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-113408",
"datePublished": "2026-11-12T07:09:19.100Z",
"dateReserved": "2026-10-20T06:03:58.616Z",
"dateUpdated": "2026-11-12T07:09:19.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105437 (GCVE-0-2026-105437)
Vulnerability from nvd – Published: 2026-11-10 18:34 – Updated: 2026-11-10 18:34
VLAI
EPSS
VEX
Title
Heap-based Buffer Overflow in Git
Summary
Affected versions of Git have a heap buffer overflow in the three-way merge
code (xdiff), which an attacker can trigger through a repository they
control.
When Git merges a file, it first adds up the size of the merged
output, allocates a buffer of that size, and then writes the output into
it. That total was kept in a 32-bit signed integer. The
conflict-marker-size attribute, which can be set from a committed
.gitattributes file, accepts any positive integer, and the markers are
written several times for every conflict. A small file with a huge marker
size and many separate conflicts can therefore push the total past 4 GiB,
so the integer wraps to a small value and Git writes attacker-controlled
merge output past the end of a buffer that is too small. At minimum this
crashes Git, and because the overflow is large and its contents are largely
attacker-controlled, worse heap corruption is possible.
Any command that does a textual three-way merge can trigger it, such
as git-merge(1), git-rebase(1), git-cherry-pick(1), and
git-merge-tree(1). The latter is most likely a target for Git forges,
which might use git-merge-tree(1) on the server-side to check
mergeability. When the server reads attributes from trees in the
repository (for example through attr.tree or --attr-source), any
user who can push branches and request that they be merged (for
example by opening a pull or merge request) can trigger the overflow
without anyone else doing anything, and the data they push is small
because the oversized output only appears during the merge.
The problem has been patched by computing the size as size_t and
checking every addition for overflow, so Git stops with an error
instead of overflowing.
Servers that cannot upgrade right away can add
* conflict-marker-size=7
to each repository's info/attributes as a workaround, which overrides
any in-tree .gitattributes, or turn off server-side mergeability checks for
untrusted repositories.
Severity
7.5 (High)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gitlab.com/gitlab-org/git/-/work_items/814 | |
| https://gitlab.com/gitlab-org/gitlab/-/work_items… | |
| https://hackerone.com/reports/4044249 | technical-descriptionexploitpermissions-required |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Git | Git |
Affected:
0 , < 2.49.1
(semver)
Affected: 2.50.0-rc0 , < 2.50.2 (semver) Affected: 2.51.0-rc0 , < 2.51.3 (semver) Affected: 2.52.0-rc0 , < 2.52.1 (semver) Affected: 2.53.0-rc0 , < 2.53.1 (semver) Affected: 2.54.0-rc0 , < 2.54.1 (semver) Affected: 2.55.0-rc0 , < 2.55.1 (semver) Affected: 2.56.0-rc0 , < 2.56.1 (semver) cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"lessThan": "2.49.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.50.2",
"status": "affected",
"version": "2.50.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.51.3",
"status": "affected",
"version": "2.51.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.52.1",
"status": "affected",
"version": "2.52.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.53.1",
"status": "affected",
"version": "2.53.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.54.1",
"status": "affected",
"version": "2.54.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.55.1",
"status": "affected",
"version": "2.55.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.56.1",
"status": "affected",
"version": "2.56.0-rc0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thanks [taise](https://hackerone.com/taise) for reporting this vulnerability through HackerOne"
}
],
"descriptions": [
{
"lang": "en",
"value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository\u0027s info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:34:09.369Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/814"
},
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"
},
{
"name": "HackerOne Bug Bounty Report #4044249",
"tags": [
"technical-description",
"exploit",
"permissions-required"
],
"url": "https://hackerone.com/reports/4044249"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Heap-based Buffer Overflow in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-105437",
"datePublished": "2026-11-10T18:34:09.369Z",
"dateReserved": "2026-10-05T13:05:02.346Z",
"dateUpdated": "2026-11-10T18:34:09.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48386 (GCVE-0-2025-48386)
Vulnerability from nvd – Published: 2025-07-08 18:23 – Updated: 2025-11-04 21:11
VLAI
EPSS
VEX
Title
Git allows a buffer overflow in 'wincred' credential helper
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 18:46 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2025/07/08/4 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48386",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T18:46:25.350003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:46:36.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:02.964Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:41.246Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr"
}
],
"source": {
"advisory": "GHSA-4v56-3xvj-xvfr",
"discovery": "UNKNOWN"
},
"title": "Git allows a buffer overflow in \u0027wincred\u0027 credential helper"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48386",
"datePublished": "2025-07-08T18:23:41.246Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2025-11-04T21:11:02.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48385 (GCVE-0-2025-48385)
Vulnerability from nvd – Published: 2025-07-08 18:23 – Updated: 2025-11-04 21:11
VLAI
EPSS
VEX
Title
Git alllows arbitrary file writes via bundle-uri parameter injection
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 18:38 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2025/07/08/4 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T18:38:28.946672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:38:41.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:01.641Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:44.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655"
}
],
"source": {
"advisory": "GHSA-m98c-vgpc-9655",
"discovery": "UNKNOWN"
},
"title": "Git alllows arbitrary file writes via bundle-uri parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48385",
"datePublished": "2025-07-08T18:23:44.405Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2025-11-04T21:11:01.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48384 (GCVE-0-2025-48384)
Vulnerability from nvd – Published: 2025-07-08 18:23 – Updated: 2026-02-26 17:51Title
Git allows arbitrary code execution through broken config quoting
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
8.1 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 03:55 UTC
CWE
Assigner
References
5 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48384",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T03:55:23.181071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-08-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:51:05.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-25T00:00:00.000Z",
"value": "CVE-2025-48384 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:00.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:48.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
}
],
"source": {
"advisory": "GHSA-vwqx-4fm8-6qc9",
"discovery": "UNKNOWN"
},
"title": "Git allows arbitrary code execution through broken config quoting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48384",
"datePublished": "2025-07-08T18:23:48.710Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2026-02-26T17:51:05.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52005 (GCVE-0-2024-52005)
Vulnerability from nvd – Published: 2025-01-15 17:35 – Updated: 2025-01-15 20:10
VLAI
EPSS
VEX
Title
The sideband payload is passed unfiltered to the terminal in git
Summary
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-15 20:10 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00E… | x_refsource_MISC |
Impacted products
1 product
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52005",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-15T20:10:33.107830Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T20:10:36.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.48.0, \u003c= 2.48.1"
},
{
"status": "affected",
"version": "\u003e= 2.47.0, \u003c= 2.47.1"
},
{
"status": "affected",
"version": "\u003e= 2.46.0, \u003c= 2.46.3"
},
{
"status": "affected",
"version": "\u003e= 2.45.0, \u003c= 2.45.3"
},
{
"status": "affected",
"version": "\u003e= 2.44.0, \u003c= 2.44.3"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c= 2.43.6"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c= 2.42.4"
},
{
"status": "affected",
"version": "\u003e= 2.41.0, \u003c= 2.41.3"
},
{
"status": "affected",
"version": "\u003c= 2.40.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T17:35:02.379Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329"
},
{
"name": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net",
"tags": [
"x_refsource_MISC"
],
"url": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"
}
],
"source": {
"advisory": "GHSA-7jjc-gg6m-3329",
"discovery": "UNKNOWN"
},
"title": "The sideband payload is passed unfiltered to the terminal in git"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52005",
"datePublished": "2025-01-15T17:35:02.379Z",
"dateReserved": "2024-11-04T17:46:16.779Z",
"dateUpdated": "2025-01-15T20:10:36.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52006 (GCVE-0-2024-52006)
Vulnerability from nvd – Published: 2025-01-14 18:39 – Updated: 2025-11-03 20:45
VLAI
EPSS
VEX
Title
Newline confusion in credential helpers can lead to credential exfiltration in git
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-14 18:52 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://github.com/git-ecosystem/git-credential-m… | x_refsource_MISC |
| https://github.com/git/git/security/advisories/GH… | x_refsource_MISC |
| https://github.com/git/git/commit/b01b9b81d36759c… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T18:52:03.897787Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T18:52:11.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:45:24.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.40.3"
},
{
"status": "affected",
"version": "\u003e= 2.41.0, \u003c= 2.41.2"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c= 2.42.3"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c= 2.43.5"
},
{
"status": "affected",
"version": "\u003e= 2.44.0, \u003c= 2.44.2"
},
{
"status": "affected",
"version": "\u003e= 2.45.0, \u003c= 2.45.2"
},
{
"status": "affected",
"version": "\u003e= 2.46.0, \u003c= 2.46.2"
},
{
"status": "affected",
"version": "\u003e= 2.47.0, \u003c 2.47.2"
},
{
"status": "affected",
"version": "= 2.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-147",
"description": "CWE-147: Improper Neutralization of Input Terminators",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T17:03:14.854Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp"
},
{
"name": "https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g"
},
{
"name": "https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q"
},
{
"name": "https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060"
}
],
"source": {
"advisory": "GHSA-r5ph-xg7q-xfrp",
"discovery": "UNKNOWN"
},
"title": "Newline confusion in credential helpers can lead to credential exfiltration in git"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52006",
"datePublished": "2025-01-14T18:39:52.748Z",
"dateReserved": "2024-11-04T17:46:16.779Z",
"dateUpdated": "2025-11-03T20:45:24.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-50349 (GCVE-0-2024-50349)
Vulnerability from nvd – Published: 2025-01-14 18:43 – Updated: 2025-11-03 20:45
VLAI
EPSS
VEX
Title
Git does not sanitize URLs when asking for credentials interactively
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-14 19:22 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://github.com/git/git/commit/7725b8100ffbbff… | x_refsource_MISC |
| https://github.com/git/git/commit/c903985bf7e772e… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-50349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T19:22:40.959774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T19:22:53.506Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:45:13.649Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.40.3"
},
{
"status": "affected",
"version": "\u003e= 2.41.0, \u003c= 2.41.2"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c= 2.42.3"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c= 2.43.5"
},
{
"status": "affected",
"version": "\u003e= 2.44.0, \u003c= 2.44.2"
},
{
"status": "affected",
"version": "\u003e= 2.45.0, \u003c= 2.45.2"
},
{
"status": "affected",
"version": "\u003e= 2.46.0, \u003c= 2.46.2"
},
{
"status": "affected",
"version": "\u003e= 2.47.0, \u003c 2.47.2"
},
{
"status": "affected",
"version": "= 2.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker\u0027s control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-147",
"description": "CWE-147: Improper Neutralization of Input Terminators",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T17:02:46.639Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr"
},
{
"name": "https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8"
},
{
"name": "https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577"
}
],
"source": {
"advisory": "GHSA-hmg8-h7qf-7cxr",
"discovery": "UNKNOWN"
},
"title": "Git does not sanitize URLs when asking for credentials interactively"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-50349",
"datePublished": "2025-01-14T18:43:42.620Z",
"dateReserved": "2024-10-22T17:54:40.957Z",
"dateUpdated": "2025-11-03T20:45:13.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-21531 (GCVE-0-2024-21531)
Vulnerability from nvd – Published: 2024-10-01 05:00 – Updated: 2024-11-07 15:26
VLAI
EPSS
VEX
Summary
All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-01 13:47 UTC
CWE
- CWE-78 - Command injection
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | git-shallow-clone |
Affected:
0 , < *
(semver)
|
|
| git | git-shallow-clone |
Affected:
0 , < *
(semver)
cpe:2.3:a:git:git-shallow-clone:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git-shallow-clone:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git-shallow-clone",
"vendor": "git",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21531",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T13:47:26.389965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T13:53:14.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "git-shallow-clone",
"vendor": "n/a",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Liran Tal - Snyk Research Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Command injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T15:26:05.308Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853"
},
{
"url": "https://github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21531",
"datePublished": "2024-10-01T05:00:05.367Z",
"dateReserved": "2023-12-22T12:33:20.122Z",
"dateUpdated": "2024-11-07T15:26:05.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32465 (GCVE-0-2024-32465)
Vulnerability from nvd – Published: 2024-05-14 19:18 – Updated: 2025-11-04 16:12
VLAI
EPSS
VEX
Title
Git's protections for cloning untrusted repositories can be bypassed
Summary
Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 14:24 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| git | git |
Affected:
= 2.45.0
Affected: = 2.44.0 Affected: >= 2.43.0, < 2.43.4 Affected: >= 2.42.0, < 2.42.2 Affected: = 2.41.0 Affected: >= 2.40.0, < 2.40.2 Affected: < 2.39.4 |
|
| git | git |
Affected:
2.45.0
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.44.0
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.43.0 , ≤ 2.43.4
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.42.0 , ≤ 2.42.2
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.41.0
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.40.0 , ≤ 2.40.2
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.39.4* , < 2.39.4
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.45.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.44.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThanOrEqual": "2.43.4",
"status": "affected",
"version": "2.43.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThanOrEqual": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.41.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThanOrEqual": "2.40.2",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.39.4",
"status": "affected",
"version": "2.39.4*",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32465",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T14:24:08.045336Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:48.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:12:12.576Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4"
},
{
"name": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7"
},
{
"name": "https://git-scm.com/docs/git#_security",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://git-scm.com/docs/git#_security"
},
{
"name": "https://git-scm.com/docs/git-clone",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://git-scm.com/docs/git-clone"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "= 2.45.0"
},
{
"status": "affected",
"version": "= 2.44.0"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c 2.43.4"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.42.2"
},
{
"status": "affected",
"version": "= 2.41.0"
},
{
"status": "affected",
"version": "\u003e= 2.40.0, \u003c 2.40.2"
},
{
"status": "affected",
"version": "\u003c 2.39.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T10:05:55.929Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4"
},
{
"name": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7"
},
{
"name": "https://git-scm.com/docs/git#_security",
"tags": [
"x_refsource_MISC"
],
"url": "https://git-scm.com/docs/git#_security"
},
{
"name": "https://git-scm.com/docs/git-clone",
"tags": [
"x_refsource_MISC"
],
"url": "https://git-scm.com/docs/git-clone"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
}
],
"source": {
"advisory": "GHSA-vm9j-46j9-qvq4",
"discovery": "UNKNOWN"
},
"title": "Git\u0027s protections for cloning untrusted repositories can be bypassed"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32465",
"datePublished": "2024-05-14T19:18:33.914Z",
"dateReserved": "2024-04-12T19:41:51.165Z",
"dateUpdated": "2025-11-04T16:12:12.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-32021 (GCVE-0-2024-32021)
Vulnerability from nvd – Published: 2024-05-14 19:15 – Updated: 2025-11-04 16:12
VLAI
EPSS
VEX
Title
Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory
Summary
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning
will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-11 20:29 UTC
CWE
- CWE-547 - Use of Hard-coded, Security-relevant Constants
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| git | git |
Affected:
= 2.45.0
Affected: = 2.44.0 Affected: >= 2.43.0, < 2.43.4 Affected: >= 2.42.0, < 2.42.2 Affected: = 2.41.0 Affected: >= 2.40.0, < 2.40.2 Affected: < 2.39.4 |
|
| git | git |
Affected:
0 , < 2.39.4
(custom)
Affected: 2.40.0 , < 2.40.2 (custom) Affected: 2.41.0 , < 2.41.1 (custom) Affected: 2.42.0 , < 2.42.2 (custom) Affected: 2.43.0 , < 2.43.4 (custom) Affected: 2.44.0 , < 2.44.1 (custom) Affected: 2.45.0 , < 2.45.1 (custom) cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.39.4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.40.2",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
},
{
"lessThan": "2.41.1",
"status": "affected",
"version": "2.41.0",
"versionType": "custom"
},
{
"lessThan": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "custom"
},
{
"lessThan": "2.43.4",
"status": "affected",
"version": "2.43.0",
"versionType": "custom"
},
{
"lessThan": "2.44.1",
"status": "affected",
"version": "2.44.0",
"versionType": "custom"
},
{
"lessThan": "2.45.1",
"status": "affected",
"version": "2.45.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32021",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T20:29:23.147248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T20:39:28.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:12:11.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "= 2.45.0"
},
{
"status": "affected",
"version": "= 2.44.0"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c 2.43.4"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.42.2"
},
{
"status": "affected",
"version": "= 2.41.0"
},
{
"status": "affected",
"version": "\u003e= 2.40.0, \u003c 2.40.2"
},
{
"status": "affected",
"version": "\u003c 2.39.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository\u0027s `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning\nwill be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-547",
"description": "CWE-547: Use of Hard-coded, Security-relevant Constants",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T10:05:54.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
}
],
"source": {
"advisory": "GHSA-mvxm-9j2h-qjx7",
"discovery": "UNKNOWN"
},
"title": "Local Git clone may hardlink arbitrary user-readable files into the new repository\u0027s \"objects/\" directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32021",
"datePublished": "2024-05-14T19:15:28.534Z",
"dateReserved": "2024-04-09T15:29:35.937Z",
"dateUpdated": "2025-11-04T16:12:11.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-32020 (GCVE-0-2024-32020)
Vulnerability from nvd – Published: 2024-05-14 18:54 – Updated: 2025-02-13 17:52
VLAI
EPSS
VEX
Title
Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will
Summary
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 14:32 UTC
CWE
- CWE-281 - Improper Preservation of Permissions
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://github.com/git/git/commit/1204e1a824c3407… | x_refsource_MISC |
| https://github.com/git/git/commit/9e65df5eab274bf… | x_refsource_MISC |
| https://lists.fedoraproject.org/archives/list/pac… | |
| http://www.openwall.com/lists/oss-security/2024/05/14/2 |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| git | git |
Affected:
= 2.45.0
Affected: = 2.44.0 Affected: >= 2.43.0, < 2.43.4 Affected: >= 2.42.0, < 2.42.2 Affected: = 2.41.0 Affected: >= 2.40.0, < 2.40.2 Affected: < 2.39.4 |
|
| git | git |
Affected:
0 , < 2.39.4
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.45.0
cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.44.0
cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.43 , < 2.43.4
(custom)
cpe:2.3:a:git:git:2.43:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.42.0 , < 2.42.2
(custom)
cpe:2.3:a:git:git:2.42.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.41.0
cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.40.0 , < 2.40.2
(custom)
cpe:2.3:a:git:git:2.40.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.39.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.45.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.44.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.43:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.43.4",
"status": "affected",
"version": "2.43",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.42.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.41.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.40.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.40.2",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T14:32:40.280977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:15:59.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:59:50.905Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj"
},
{
"name": "https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d"
},
{
"name": "https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "= 2.45.0"
},
{
"status": "affected",
"version": "= 2.44.0"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c 2.43.4"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.42.2"
},
{
"status": "affected",
"version": "= 2.41.0"
},
{
"status": "affected",
"version": "\u003e= 2.40.0, \u003c 2.40.2"
},
{
"status": "affected",
"version": "\u003c 2.39.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository\u0027s object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a \"proper\" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281: Improper Preservation of Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T17:10:03.915Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj"
},
{
"name": "https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d"
},
{
"name": "https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
}
],
"source": {
"advisory": "GHSA-5rfh-556j-fhgj",
"discovery": "UNKNOWN"
},
"title": "Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32020",
"datePublished": "2024-05-14T18:54:08.184Z",
"dateReserved": "2024-04-09T15:29:35.937Z",
"dateUpdated": "2025-02-13T17:52:05.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32004 (GCVE-0-2024-32004)
Vulnerability from nvd – Published: 2024-05-14 18:46 – Updated: 2025-11-04 16:12
VLAI
EPSS
VEX
Title
Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
Summary
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 17:59 UTC
CWE
- CWE-114 - Process Control
Assigner
References
7 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| git | git |
Affected:
= 2.45.0
Affected: = 2.44.0 Affected: >= 2.43.0, < 2.43.4 Affected: >= 2.42.0, < 2.42.2 Affected: = 2.41.0 Affected: >= 2.40.0, < 2.40.2 Affected: < 2.39.4 |
|
| git | git |
Affected:
2.45.0
cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.44.0
cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.43.0 , < 2.43.4
(custom)
cpe:2.3:a:git:git:2.43.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.42.0 , < 2.42.2
(custom)
cpe:2.3:a:git:git:2.42.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.41.0
cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.40.0 , < 2.40.2
(custom)
cpe:2.3:a:git:git:2.40.0:*:*:*:*:*:*:* |
|
| git | git |
Affected:
0 , < 2.39.4
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:12:10.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389"
},
{
"name": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8"
},
{
"name": "https://git-scm.com/docs/git-clone",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://git-scm.com/docs/git-clone"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.45.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.44.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.43.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.43.4",
"status": "affected",
"version": "2.43.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.42.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.41.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:2.40.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.40.2",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.39.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32004",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T17:59:29.364044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-09T18:41:23.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "= 2.45.0"
},
{
"status": "affected",
"version": "= 2.44.0"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c 2.43.4"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.42.2"
},
{
"status": "affected",
"version": "= 2.41.0"
},
{
"status": "affected",
"version": "\u003e= 2.40.0, \u003c 2.40.2"
},
{
"status": "affected",
"version": "\u003c 2.39.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-114",
"description": "CWE-114: Process Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T10:06:05.293Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389"
},
{
"name": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8"
},
{
"name": "https://git-scm.com/docs/git-clone",
"tags": [
"x_refsource_MISC"
],
"url": "https://git-scm.com/docs/git-clone"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
}
],
"source": {
"advisory": "GHSA-xfc6-vwr8-r389",
"discovery": "UNKNOWN"
},
"title": "Git vulnerable to Remote Code Execution while cloning special-crafted local repositories"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32004",
"datePublished": "2024-05-14T18:46:32.192Z",
"dateReserved": "2024-04-08T13:48:37.493Z",
"dateUpdated": "2025-11-04T16:12:10.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114467 (GCVE-0-2026-114467)
Vulnerability from cvelistv5 – Published: 2026-11-12 13:13 – Updated: 2026-11-12 13:13
VLAI
EPSS
VEX
Title
Out-of-bounds Write in Git
Summary
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:13:05.067Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/810"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Out-of-bounds Write in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-114467",
"datePublished": "2026-11-12T13:13:05.067Z",
"dateReserved": "2026-10-21T15:02:50.482Z",
"dateUpdated": "2026-11-12T13:13:05.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114466 (GCVE-0-2026-114466)
Vulnerability from cvelistv5 – Published: 2026-11-12 13:13 – Updated: 2026-11-12 13:13
VLAI
EPSS
VEX
Title
Insufficient Granularity of Access Control in Git
Summary
Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe
Severity
4.4 (Medium)
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:13:00.071Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/812"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Insufficient Granularity of Access Control in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-114466",
"datePublished": "2026-11-12T13:13:00.071Z",
"dateReserved": "2026-10-21T15:02:45.478Z",
"dateUpdated": "2026-11-12T13:13:00.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114469 (GCVE-0-2026-114469)
Vulnerability from cvelistv5 – Published: 2026-11-12 13:12 – Updated: 2026-11-12 13:12
VLAI
EPSS
VEX
Title
Out-of-bounds Read in Git
Summary
Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size
Severity
4.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:12:55.269Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/811"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Out-of-bounds Read in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-114469",
"datePublished": "2026-11-12T13:12:55.269Z",
"dateReserved": "2026-10-21T15:02:55.490Z",
"dateUpdated": "2026-11-12T13:12:55.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113408 (GCVE-0-2026-113408)
Vulnerability from cvelistv5 – Published: 2026-11-12 07:09 – Updated: 2026-11-12 07:09
VLAI
EPSS
VEX
Title
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git
Summary
Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"status": "affected",
"version": "2.50.1"
},
{
"status": "affected",
"version": "2.51.2"
},
{
"status": "affected",
"version": "2.52.0"
},
{
"status": "affected",
"version": "2.53.0"
},
{
"status": "affected",
"version": "2.54.0"
},
{
"status": "affected",
"version": "2.55.0"
},
{
"status": "affected",
"version": "2.56.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ehdgks0627, un3xploitable"
}
],
"descriptions": [
{
"lang": "en",
"value": "Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T07:09:19.100Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/809"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-113408",
"datePublished": "2026-11-12T07:09:19.100Z",
"dateReserved": "2026-10-20T06:03:58.616Z",
"dateUpdated": "2026-11-12T07:09:19.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105437 (GCVE-0-2026-105437)
Vulnerability from cvelistv5 – Published: 2026-11-10 18:34 – Updated: 2026-11-10 18:34
VLAI
EPSS
VEX
Title
Heap-based Buffer Overflow in Git
Summary
Affected versions of Git have a heap buffer overflow in the three-way merge
code (xdiff), which an attacker can trigger through a repository they
control.
When Git merges a file, it first adds up the size of the merged
output, allocates a buffer of that size, and then writes the output into
it. That total was kept in a 32-bit signed integer. The
conflict-marker-size attribute, which can be set from a committed
.gitattributes file, accepts any positive integer, and the markers are
written several times for every conflict. A small file with a huge marker
size and many separate conflicts can therefore push the total past 4 GiB,
so the integer wraps to a small value and Git writes attacker-controlled
merge output past the end of a buffer that is too small. At minimum this
crashes Git, and because the overflow is large and its contents are largely
attacker-controlled, worse heap corruption is possible.
Any command that does a textual three-way merge can trigger it, such
as git-merge(1), git-rebase(1), git-cherry-pick(1), and
git-merge-tree(1). The latter is most likely a target for Git forges,
which might use git-merge-tree(1) on the server-side to check
mergeability. When the server reads attributes from trees in the
repository (for example through attr.tree or --attr-source), any
user who can push branches and request that they be merged (for
example by opening a pull or merge request) can trigger the overflow
without anyone else doing anything, and the data they push is small
because the oversized output only appears during the merge.
The problem has been patched by computing the size as size_t and
checking every addition for overflow, so Git stops with an error
instead of overflowing.
Servers that cannot upgrade right away can add
* conflict-marker-size=7
to each repository's info/attributes as a workaround, which overrides
any in-tree .gitattributes, or turn off server-side mergeability checks for
untrusted repositories.
Severity
7.5 (High)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gitlab.com/gitlab-org/git/-/work_items/814 | |
| https://gitlab.com/gitlab-org/gitlab/-/work_items… | |
| https://hackerone.com/reports/4044249 | technical-descriptionexploitpermissions-required |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Git | Git |
Affected:
0 , < 2.49.1
(semver)
Affected: 2.50.0-rc0 , < 2.50.2 (semver) Affected: 2.51.0-rc0 , < 2.51.3 (semver) Affected: 2.52.0-rc0 , < 2.52.1 (semver) Affected: 2.53.0-rc0 , < 2.53.1 (semver) Affected: 2.54.0-rc0 , < 2.54.1 (semver) Affected: 2.55.0-rc0 , < 2.55.1 (semver) Affected: 2.56.0-rc0 , < 2.56.1 (semver) cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Git",
"repo": "https://gitlab.com/git-scm/git",
"vendor": "Git",
"versions": [
{
"lessThan": "2.49.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.50.2",
"status": "affected",
"version": "2.50.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.51.3",
"status": "affected",
"version": "2.51.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.52.1",
"status": "affected",
"version": "2.52.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.53.1",
"status": "affected",
"version": "2.53.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.54.1",
"status": "affected",
"version": "2.54.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.55.1",
"status": "affected",
"version": "2.55.0-rc0",
"versionType": "semver"
},
{
"lessThan": "2.56.1",
"status": "affected",
"version": "2.56.0-rc0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thanks [taise](https://hackerone.com/taise) for reporting this vulnerability through HackerOne"
}
],
"descriptions": [
{
"lang": "en",
"value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository\u0027s info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:34:09.369Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/git/-/work_items/814"
},
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"
},
{
"name": "HackerOne Bug Bounty Report #4044249",
"tags": [
"technical-description",
"exploit",
"permissions-required"
],
"url": "https://hackerone.com/reports/4044249"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
}
],
"title": "Heap-based Buffer Overflow in Git"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-105437",
"datePublished": "2026-11-10T18:34:09.369Z",
"dateReserved": "2026-10-05T13:05:02.346Z",
"dateUpdated": "2026-11-10T18:34:09.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48384 (GCVE-0-2025-48384)
Vulnerability from cvelistv5 – Published: 2025-07-08 18:23 – Updated: 2026-02-26 17:51Title
Git allows arbitrary code execution through broken config quoting
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
8.1 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 03:55 UTC
CWE
Assigner
References
5 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48384",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T03:55:23.181071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-08-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:51:05.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-25T00:00:00.000Z",
"value": "CVE-2025-48384 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:00.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:48.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
}
],
"source": {
"advisory": "GHSA-vwqx-4fm8-6qc9",
"discovery": "UNKNOWN"
},
"title": "Git allows arbitrary code execution through broken config quoting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48384",
"datePublished": "2025-07-08T18:23:48.710Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2026-02-26T17:51:05.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48385 (GCVE-0-2025-48385)
Vulnerability from cvelistv5 – Published: 2025-07-08 18:23 – Updated: 2025-11-04 21:11
VLAI
EPSS
VEX
Title
Git alllows arbitrary file writes via bundle-uri parameter injection
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 18:38 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2025/07/08/4 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T18:38:28.946672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:38:41.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:01.641Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:44.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655"
}
],
"source": {
"advisory": "GHSA-m98c-vgpc-9655",
"discovery": "UNKNOWN"
},
"title": "Git alllows arbitrary file writes via bundle-uri parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48385",
"datePublished": "2025-07-08T18:23:44.405Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2025-11-04T21:11:01.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48386 (GCVE-0-2025-48386)
Vulnerability from cvelistv5 – Published: 2025-07-08 18:23 – Updated: 2025-11-04 21:11
VLAI
EPSS
VEX
Title
Git allows a buffer overflow in 'wincred' credential helper
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 18:46 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2025/07/08/4 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48386",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T18:46:25.350003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:46:36.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:02.964Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:41.246Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr"
}
],
"source": {
"advisory": "GHSA-4v56-3xvj-xvfr",
"discovery": "UNKNOWN"
},
"title": "Git allows a buffer overflow in \u0027wincred\u0027 credential helper"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48386",
"datePublished": "2025-07-08T18:23:41.246Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2025-11-04T21:11:02.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52005 (GCVE-0-2024-52005)
Vulnerability from cvelistv5 – Published: 2025-01-15 17:35 – Updated: 2025-01-15 20:10
VLAI
EPSS
VEX
Title
The sideband payload is passed unfiltered to the terminal in git
Summary
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-15 20:10 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00E… | x_refsource_MISC |
Impacted products
1 product
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52005",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-15T20:10:33.107830Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T20:10:36.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.48.0, \u003c= 2.48.1"
},
{
"status": "affected",
"version": "\u003e= 2.47.0, \u003c= 2.47.1"
},
{
"status": "affected",
"version": "\u003e= 2.46.0, \u003c= 2.46.3"
},
{
"status": "affected",
"version": "\u003e= 2.45.0, \u003c= 2.45.3"
},
{
"status": "affected",
"version": "\u003e= 2.44.0, \u003c= 2.44.3"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c= 2.43.6"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c= 2.42.4"
},
{
"status": "affected",
"version": "\u003e= 2.41.0, \u003c= 2.41.3"
},
{
"status": "affected",
"version": "\u003c= 2.40.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T17:35:02.379Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329"
},
{
"name": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net",
"tags": [
"x_refsource_MISC"
],
"url": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"
}
],
"source": {
"advisory": "GHSA-7jjc-gg6m-3329",
"discovery": "UNKNOWN"
},
"title": "The sideband payload is passed unfiltered to the terminal in git"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52005",
"datePublished": "2025-01-15T17:35:02.379Z",
"dateReserved": "2024-11-04T17:46:16.779Z",
"dateUpdated": "2025-01-15T20:10:36.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-50349 (GCVE-0-2024-50349)
Vulnerability from cvelistv5 – Published: 2025-01-14 18:43 – Updated: 2025-11-03 20:45
VLAI
EPSS
VEX
Title
Git does not sanitize URLs when asking for credentials interactively
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-14 19:22 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://github.com/git/git/commit/7725b8100ffbbff… | x_refsource_MISC |
| https://github.com/git/git/commit/c903985bf7e772e… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-50349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T19:22:40.959774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T19:22:53.506Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:45:13.649Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.40.3"
},
{
"status": "affected",
"version": "\u003e= 2.41.0, \u003c= 2.41.2"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c= 2.42.3"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c= 2.43.5"
},
{
"status": "affected",
"version": "\u003e= 2.44.0, \u003c= 2.44.2"
},
{
"status": "affected",
"version": "\u003e= 2.45.0, \u003c= 2.45.2"
},
{
"status": "affected",
"version": "\u003e= 2.46.0, \u003c= 2.46.2"
},
{
"status": "affected",
"version": "\u003e= 2.47.0, \u003c 2.47.2"
},
{
"status": "affected",
"version": "= 2.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker\u0027s control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-147",
"description": "CWE-147: Improper Neutralization of Input Terminators",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T17:02:46.639Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr"
},
{
"name": "https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8"
},
{
"name": "https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577"
}
],
"source": {
"advisory": "GHSA-hmg8-h7qf-7cxr",
"discovery": "UNKNOWN"
},
"title": "Git does not sanitize URLs when asking for credentials interactively"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-50349",
"datePublished": "2025-01-14T18:43:42.620Z",
"dateReserved": "2024-10-22T17:54:40.957Z",
"dateUpdated": "2025-11-03T20:45:13.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52006 (GCVE-0-2024-52006)
Vulnerability from cvelistv5 – Published: 2025-01-14 18:39 – Updated: 2025-11-03 20:45
VLAI
EPSS
VEX
Title
Newline confusion in credential helpers can lead to credential exfiltration in git
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-14 18:52 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/git/git/security/advisories/GH… | x_refsource_CONFIRM |
| https://github.com/git-ecosystem/git-credential-m… | x_refsource_MISC |
| https://github.com/git/git/security/advisories/GH… | x_refsource_MISC |
| https://github.com/git/git/commit/b01b9b81d36759c… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T18:52:03.897787Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T18:52:11.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:45:24.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.40.3"
},
{
"status": "affected",
"version": "\u003e= 2.41.0, \u003c= 2.41.2"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c= 2.42.3"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c= 2.43.5"
},
{
"status": "affected",
"version": "\u003e= 2.44.0, \u003c= 2.44.2"
},
{
"status": "affected",
"version": "\u003e= 2.45.0, \u003c= 2.45.2"
},
{
"status": "affected",
"version": "\u003e= 2.46.0, \u003c= 2.46.2"
},
{
"status": "affected",
"version": "\u003e= 2.47.0, \u003c 2.47.2"
},
{
"status": "affected",
"version": "= 2.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-147",
"description": "CWE-147: Improper Neutralization of Input Terminators",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T17:03:14.854Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp"
},
{
"name": "https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g"
},
{
"name": "https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q"
},
{
"name": "https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060"
}
],
"source": {
"advisory": "GHSA-r5ph-xg7q-xfrp",
"discovery": "UNKNOWN"
},
"title": "Newline confusion in credential helpers can lead to credential exfiltration in git"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52006",
"datePublished": "2025-01-14T18:39:52.748Z",
"dateReserved": "2024-11-04T17:46:16.779Z",
"dateUpdated": "2025-11-03T20:45:24.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-21531 (GCVE-0-2024-21531)
Vulnerability from cvelistv5 – Published: 2024-10-01 05:00 – Updated: 2024-11-07 15:26
VLAI
EPSS
VEX
Summary
All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-01 13:47 UTC
CWE
- CWE-78 - Command injection
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | git-shallow-clone |
Affected:
0 , < *
(semver)
|
|
| git | git-shallow-clone |
Affected:
0 , < *
(semver)
cpe:2.3:a:git:git-shallow-clone:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git-shallow-clone:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git-shallow-clone",
"vendor": "git",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21531",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T13:47:26.389965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T13:53:14.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "git-shallow-clone",
"vendor": "n/a",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Liran Tal - Snyk Research Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Command injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T15:26:05.308Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853"
},
{
"url": "https://github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21531",
"datePublished": "2024-10-01T05:00:05.367Z",
"dateReserved": "2023-12-22T12:33:20.122Z",
"dateUpdated": "2024-11-07T15:26:05.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32465 (GCVE-0-2024-32465)
Vulnerability from cvelistv5 – Published: 2024-05-14 19:18 – Updated: 2025-11-04 16:12
VLAI
EPSS
VEX
Title
Git's protections for cloning untrusted repositories can be bypassed
Summary
Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 14:24 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| git | git |
Affected:
= 2.45.0
Affected: = 2.44.0 Affected: >= 2.43.0, < 2.43.4 Affected: >= 2.42.0, < 2.42.2 Affected: = 2.41.0 Affected: >= 2.40.0, < 2.40.2 Affected: < 2.39.4 |
|
| git | git |
Affected:
2.45.0
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.44.0
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.43.0 , ≤ 2.43.4
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.42.0 , ≤ 2.42.2
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.41.0
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.40.0 , ≤ 2.40.2
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
|
| git | git |
Affected:
2.39.4* , < 2.39.4
(custom)
cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.45.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.44.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThanOrEqual": "2.43.4",
"status": "affected",
"version": "2.43.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThanOrEqual": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "2.41.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThanOrEqual": "2.40.2",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.39.4",
"status": "affected",
"version": "2.39.4*",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32465",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T14:24:08.045336Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:48.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:12:12.576Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4"
},
{
"name": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7"
},
{
"name": "https://git-scm.com/docs/git#_security",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://git-scm.com/docs/git#_security"
},
{
"name": "https://git-scm.com/docs/git-clone",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://git-scm.com/docs/git-clone"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "= 2.45.0"
},
{
"status": "affected",
"version": "= 2.44.0"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c 2.43.4"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.42.2"
},
{
"status": "affected",
"version": "= 2.41.0"
},
{
"status": "affected",
"version": "\u003e= 2.40.0, \u003c 2.40.2"
},
{
"status": "affected",
"version": "\u003c 2.39.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T10:05:55.929Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4"
},
{
"name": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7"
},
{
"name": "https://git-scm.com/docs/git#_security",
"tags": [
"x_refsource_MISC"
],
"url": "https://git-scm.com/docs/git#_security"
},
{
"name": "https://git-scm.com/docs/git-clone",
"tags": [
"x_refsource_MISC"
],
"url": "https://git-scm.com/docs/git-clone"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
}
],
"source": {
"advisory": "GHSA-vm9j-46j9-qvq4",
"discovery": "UNKNOWN"
},
"title": "Git\u0027s protections for cloning untrusted repositories can be bypassed"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32465",
"datePublished": "2024-05-14T19:18:33.914Z",
"dateReserved": "2024-04-12T19:41:51.165Z",
"dateUpdated": "2025-11-04T16:12:12.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-32021 (GCVE-0-2024-32021)
Vulnerability from cvelistv5 – Published: 2024-05-14 19:15 – Updated: 2025-11-04 16:12
VLAI
EPSS
VEX
Title
Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory
Summary
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning
will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-11 20:29 UTC
CWE
- CWE-547 - Use of Hard-coded, Security-relevant Constants
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| git | git |
Affected:
= 2.45.0
Affected: = 2.44.0 Affected: >= 2.43.0, < 2.43.4 Affected: >= 2.42.0, < 2.42.2 Affected: = 2.41.0 Affected: >= 2.40.0, < 2.40.2 Affected: < 2.39.4 |
|
| git | git |
Affected:
0 , < 2.39.4
(custom)
Affected: 2.40.0 , < 2.40.2 (custom) Affected: 2.41.0 , < 2.41.1 (custom) Affected: 2.42.0 , < 2.42.2 (custom) Affected: 2.43.0 , < 2.43.4 (custom) Affected: 2.44.0 , < 2.44.1 (custom) Affected: 2.45.0 , < 2.45.1 (custom) cpe:2.3:a:git:git:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "git",
"vendor": "git",
"versions": [
{
"lessThan": "2.39.4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.40.2",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
},
{
"lessThan": "2.41.1",
"status": "affected",
"version": "2.41.0",
"versionType": "custom"
},
{
"lessThan": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "custom"
},
{
"lessThan": "2.43.4",
"status": "affected",
"version": "2.43.0",
"versionType": "custom"
},
{
"lessThan": "2.44.1",
"status": "affected",
"version": "2.44.0",
"versionType": "custom"
},
{
"lessThan": "2.45.1",
"status": "affected",
"version": "2.45.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32021",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T20:29:23.147248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T20:39:28.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:12:11.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "= 2.45.0"
},
{
"status": "affected",
"version": "= 2.44.0"
},
{
"status": "affected",
"version": "\u003e= 2.43.0, \u003c 2.43.4"
},
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.42.2"
},
{
"status": "affected",
"version": "= 2.41.0"
},
{
"status": "affected",
"version": "\u003e= 2.40.0, \u003c 2.40.2"
},
{
"status": "affected",
"version": "\u003c 2.39.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository\u0027s `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning\nwill be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-547",
"description": "CWE-547: Use of Hard-coded, Security-relevant Constants",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T10:05:54.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/05/14/2"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
}
],
"source": {
"advisory": "GHSA-mvxm-9j2h-qjx7",
"discovery": "UNKNOWN"
},
"title": "Local Git clone may hardlink arbitrary user-readable files into the new repository\u0027s \"objects/\" directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32021",
"datePublished": "2024-05-14T19:15:28.534Z",
"dateReserved": "2024-04-09T15:29:35.937Z",
"dateUpdated": "2025-11-04T16:12:11.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}