USN-5376-5
git regression
USN-5376-4 fixed a regression in Git. The update introduced a regression when specifying configuration includes due to additional restrictions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker could possibly use this issue to run arbitrary commands.
What each source reports
OSV No score
git regression
USN-5376-4 fixed a regression in Git. The update introduced a regression when specifying configuration includes due to additional restrictions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker could possibly use this issue to run arbitrary commands.
- Record
USN-5376-5- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gitUbuntu:Pro:20.04:LTS |
before 1:2.25.1-1ubuntu3.14+esm5, plus listed versions 1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu1 Show 19 moreShow less1:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.21:2.25.1-1ubuntu3.31:2.25.1-1ubuntu3.41:2.25.1-1ubuntu3.51:2.25.1-1ubuntu3.61:2.25.1-1ubuntu3.71:2.25.1-1ubuntu3.81:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.111:2.25.1-1ubuntu3.121:2.25.1-1ubuntu3.131:2.25.1-1ubuntu3.141:2.25.1-1ubuntu3.14+esm11:2.25.1-1ubuntu3.14+esm21:2.25.1-1ubuntu3.14+esm31:2.25.1-1ubuntu3.14+esm4 |
1:2.25.1-1ubuntu3.14+esm5 |
gitUbuntu:22.04:LTS |
before 1:2.34.1-1ubuntu1.17, plus listed versions 1:2.32.0-1ubuntu11:2.33.1-1ubuntu11:2.34.1-1ubuntu11:2.34.1-1ubuntu1.11:2.34.1-1ubuntu1.2 Show 12 moreShow less1:2.34.1-1ubuntu1.41:2.34.1-1ubuntu1.51:2.34.1-1ubuntu1.61:2.34.1-1ubuntu1.81:2.34.1-1ubuntu1.91:2.34.1-1ubuntu1.101:2.34.1-1ubuntu1.111:2.34.1-1ubuntu1.121:2.34.1-1ubuntu1.131:2.34.1-1ubuntu1.141:2.34.1-1ubuntu1.151:2.34.1-1ubuntu1.16 |
1:2.34.1-1ubuntu1.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5376-5 is a vulnerability with no CVSS score yet in git, published February 27, 2026. No source lists public exploit code. Fixed in git 1:2.25.1-1ubuntu3.14+esm5.