CVE-2024-50349

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and ClearCase with features like cheap local branching, convenient staging areas, and multiple workflows.

Security Fix(es):

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.(CVE-2024-50349)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit b01b9b8 which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.(CVE-2024-52006)

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

• git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)

• git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)

• git: Git arbitrary code execution (CVE-2025-48384)

• git: Git arbitrary file writes (CVE-2025-48385)

• gitk: Git file creation flaw (CVE-2025-27613)

• gitk: git script execution flaw (CVE-2025-27614)

• git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

• git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)

• git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)

• git: Git arbitrary code execution (CVE-2025-48384)

• git: Git arbitrary file writes (CVE-2025-48385)

• gitk: Git file creation flaw (CVE-2025-27613)

• gitk: git script execution flaw (CVE-2025-27614)

• git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

• git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)
• git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)
• git: Git arbitrary code execution (CVE-2025-48384)
• git: Git arbitrary file writes (CVE-2025-48385)
• gitk: Git file creation flaw (CVE-2025-27613)
• gitk: git script execution flaw (CVE-2025-27614)
• git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

• git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)
• git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)
• git: Git arbitrary code execution (CVE-2025-48384)
• git: Git arbitrary file writes (CVE-2025-48385)
• gitk: Git file creation flaw (CVE-2025-27613)
• gitk: git script execution flaw (CVE-2025-27614)
• git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

• git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)
• git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)
• git: Git arbitrary code execution (CVE-2025-48384)
• git: Git arbitrary file writes (CVE-2025-48385)
• gitk: Git file creation flaw (CVE-2025-27613)
• gitk: git script execution flaw (CVE-2025-27614)
• git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

• CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively

• CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively

• CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively

• CVE-2024-50349: fix issue where URLs can obfuscate the host asking for credentials, by using strbuf_add_percentencode to sanitise the host name and port

• CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively

• SECURITY UPDATE: improper encoding or escaping of credential handling

• debian/patches/CVE-2024-50349.patch: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively
• CVE-2024-50349

• CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively

• CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively

• SECURITY UPDATE: Confusing users into sending their passwords to sites under the attacker’s control using crafted URLs
  • debian/patches/CVE-2024-50349.patch: also encode <host>[:<port>] in credential_format(), sanitize the user prompt
  • CVE-2024-50349

• SECURITY UPDATE: Confusing users into sending their passwords to sites under the attacker’s control using crafted URLs
  • debian/patches/CVE-2024-50349.patch: also encode <host>[:<port>] in credential_format(), sanitize the user prompt
  • CVE-2024-50349

Git does not sanitize URLs when asking for credentials interactively. (CVE-2024-50349) Newline confusion in credential helpers can lead to credential exfiltration in git. (CVE-2024-52006)

These are all security issues fixed in the git-2.48.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for git fixes the following issues:

• CVE-2024-50349: passwords for trusted sites could be sent to untrusted sites (bsc#1235600)
• CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601)

This update for git fixes the following issues:

• CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
• CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

This update for git fixes the following issues:

• CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
• CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

This update for git fixes the following issues:

• CVE-2024-32002: Fix recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion. (bsc#1224168)
• CVE-2024-32004: Fixed arbitrary code execution during local clones. (bsc#1224170)
• CVE-2024-32020: Fix file overwriting vulnerability during local clones. (bsc#1224171)
• CVE-2024-32021: Git may create hardlinks to arbitrary user-readable files. (bsc#1224172)
• CVE-2024-32465: Fixed arbitrary code execution during clone operations. (bsc#1224173)
• CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
• CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

This update for git fixes the following issues:

• CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
• CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

This update for git fixes the following issues:

• Update to 2.51.0

  • UI, Workflows & Features
    • Userdiff patterns for the R language have been added.
    • Documentation for "git send-email" has been updated with a bit more credential helper and OAuth information.
    • "git cat-file --batch" learns to understand %(objectmode) atom to allow the caller to tell missing objects (due to repository corruption) and submodules (whose commit objects are OK to be missing) apart.
    • "git diff --no-index dirA dirB" can limit the comparison with pathspec at the end of the command line, just like normal "git diff".
    • "git subtree" (in contrib/) learned to grok GPG signing its commits.
    • "git whatchanged" that is longer to type than "git log --raw" which is its modern rough equivalent has outlived its usefulness more than 10 years ago. Plan to deprecate and remove it.
    • An interchange format for stash entries is defined, and subcommand of "git stash" to import/export has been added.
    • "git merge/pull" has been taught the "--compact-summary" option to use the compact-summary format, intead of diffstat, when showing the summary of the incoming changes.
    • "git imap-send" has been broken for a long time, which has been resurrected and then taught to talk OAuth2.0 etc.
    • Some error messages from "git imap-send" has been updated.
    • When "git daemon" sees a signal while attempting to accept() a new client, instead of retrying, it skipped it by mistake, which has been corrected.
    • The reftable ref backend has matured enough; Git 3.0 will make it the default format in a newly created repositories by default.
    • "netrc" credential helper has been improved to understand textual service names (like smtp) in addition to the numeric port numbers (like 25).
    • Lift the limitation to use changed-path filter in "git log" so that it can be used for a pathspec with multiple literal paths.
    • Clean up the way how signature on commit objects are exported to and imported from fast-import stream.
    • Remove unsupported, unused, and unsupportable old option from "git log".
    • Document recently added "git imap-send --list" with an example.
    • "git pull" learned to pay attention to pull.autostash configuration variable, which overrides rebase/merge.autostash.
    • "git for-each-ref" learns "--start-after" option to help applications that want to page its output.
    • "git switch" and "git restore" are declared to be no longer experimental.
    • "git -c alias.foo=bar foo -h baz" reported "'foo' is aliased to 'bar'" and then went on to run "git foo -h baz", which was unexpected. Tighten the rule so that alias expansion is reported only when "-h" is the sole option.
  • Performance, Internal Implementation, Development Support etc.
    • "git pack-objects" learned to find delta bases from blobs at the same path, using the --path-walk API.
    • CodingGuidelines update.
    • Add settings for Solaris 10 & 11.
    • Meson-based build/test framework now understands TAP output generated by our tests.
    • "Do not explicitly initialize to zero" rule has been clarified in the CodingGuidelines document.
    • A test helper "test_seq" function learned the "-f <fmt>" option, which allowed us to simplify a lot of test scripts.
    • A lot of stale stuff has been removed from the contrib/ hierarchy.
    • "git push" and "git fetch" are taught to update refs in batches to gain performance.
    • Some code paths in "git prune" used to ignore the passed-in repository object and used the the_repository singleton instance instead, which has been corrected.
    • Update ".clang-format" and ".editorconfig" to match our style guide a bit better.
    • "make coccicheck"…

It was discovered that Git incorrectly handled certain URLs when asking for credentials. An attacker could possibly use this issue to mislead the user into typing passwords for trusted sites that would then be sent to untrusted sites instead. (CVE-2024-50349)

It was discovered that git incorrectly handled line endings when using credential helpers. (CVE-2024-52006)

USN-7207-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that Git incorrectly handled certain URLs when asking for credentials. An attacker could possibly use this issue to mislead the user into typing passwords for trusted sites that would then be sent to untrusted sites instead. (CVE-2024-50349)

It was discovered that git incorrectly handled line endings when using credential helpers. (CVE-2024-52006)

It was discovered that Git did not properly sanitize URLs when asking for credentials via a terminal prompt. An attacker could possibly use this issue to trick a user into disclosing their password. (CVE-2024-50349)

It was discovered that Git did not properly handle carriage return characters in its credential protocol. An attacker could use this issue to send unexpected data to credential helpers, possibly leading to a user being tricked into disclosing sensitive information. (CVE-2024-52006)