Skip to content

git vulnerabilities (Red Hat)

40 vulnerabilities.

git Red Hat Git alllows arbitrary file writes via bundle-uri parameter injection CVE-2025-48385 Fix available 8.6 HighJuly 8, 2025
git Red Hat Git allows arbitrary code execution through broken config quoting CVE-2025-48384 In KEVPublic exploitFix available 8.1 HighJuly 8, 2025
git Red Hat Git GUI can create and overwrite files for which the user has write permission CVE-2025-46835 Fix available 8.5 HighJuly 8, 2025
git Red Hat Gitk allows arbitrary command execution CVE-2025-27614 Fix available 8.6 HighJuly 8, 2025
git Red Hat Gitk can create and truncate files in the user's home directory CVE-2025-27613 Fix available 3.6 LowJuly 8, 2025
git Red Hat The sideband payload is passed unfiltered to the terminal in git CVE-2024-52005 Public exploitFix available 7.5 HighJanuary 15, 2025
git Red Hat Newline confusion in credential helpers can lead to credential exfiltration in git CVE-2024-52006 Fix available 2.1 LowJanuary 14, 2025
git Red Hat Git does not sanitize URLs when asking for credentials interactively CVE-2024-50349 Fix available 2.1 LowJanuary 14, 2025
git Red Hat Git's protections for cloning untrusted repositories can be bypassed CVE-2024-32465 Fix available 7.4 HighMay 14, 2024
git Red Hat Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVE-2024-32021 Fix available 3.9 LowMay 14, 2024
git Red Hat Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will CVE-2024-32020 Fix available 3.9 LowMay 14, 2024
git Red Hat Git vulnerable to Remote Code Execution while cloning special-crafted local repositories CVE-2024-32004 Public exploitFix available 8.2 HighMay 14, 2024
git Red Hat Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVE-2024-32002 Public exploitFix available EPSS 29.2% 9.1 CriticalMay 14, 2024
git Red Hat Arbitrary configuration injection via `git submodule deinit` CVE-2023-29007 Public exploitFix available 7.0 HighApril 25, 2023
git Red Hat Git looks for localized messages in the wrong place CVE-2023-25815 Fix available 3.3 LowApril 25, 2023
git Red Hat "git apply --reject" partially-controlled arbitrary file write CVE-2023-25652 Fix available EPSS 51.9% 7.5 HighApril 25, 2023
git Red Hat Git's `git apply` overwriting paths outside the working tree CVE-2023-23946 Public exploitFix available 6.2 MediumFebruary 14, 2023
git Red Hat Git vulnerable to local clone-based data exfiltration with non-local transports CVE-2023-22490 Public exploitFix available 5.5 MediumFebruary 14, 2023
git Red Hat Integer overflow in `git archive`, `git log --format` leading to RCE in git CVE-2022-41903 Public exploitFix available EPSS 44.3% 9.8 CriticalJanuary 17, 2023
git Red Hat gitattributes parsing integer overflow in git CVE-2022-23521 Fix available EPSS 56.3% 9.8 CriticalJanuary 17, 2023
git Red Hat Git vulnerable to Remote Code Execution via Heap overflow in `git shell` CVE-2022-39260 Fix available 8.5 HighOctober 18, 2022
git Red Hat Git subject to exposure of sensitive information via local clone of symbolic links CVE-2022-39253 Public exploitFix available 5.5 MediumOctober 18, 2022
git Red Hat Bypass of safe.directory protections in Git CVE-2022-29187 Fix available 7.8 HighJuly 12, 2022
git Red Hat Uncontrolled search for the Git directory in Git for Windows CVE-2022-24765 Fix available 6.0 MediumApril 12, 2022
git Red Hat Malicious URLs can still cause Git to send a stored credential to the wrong server CVE-2020-11008 Fix available 4.0 MediumApril 20, 2020
git Red Hat malicious URLs may cause Git to present stored credentials to the wrong server CVE-2020-5260 Public exploitFix available EPSS 14.9% 9.3 CriticalApril 14, 2020
git Red Hat An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2,... CVE-2019-1387 Fix available 8.8 HighDecember 10, 2019
git Red Hat A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes... CVE-2019-1352 Fix available EPSS 24.0% 8.8 HighDecember 10, 2019
git Red Hat A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes... CVE-2019-1349 Fix available EPSS 34.0% 8.8 HighDecember 10, 2019
git Red Hat CVE-2019-1348 does not affect BellSoft software CVE-2019-1348 Fix available 3.3 LowDecember 10, 2019
git Red Hat Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x... CVE-2018-17456 Public exploitFix available EPSS 97.4% 9.8 CriticalOctober 5, 2018
git Red Hat In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17... CVE-2018-11235 Public exploitFix available EPSS 48.1% 7.8 HighMay 29, 2018
git Red Hat A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an... CVE-2017-1000117 Public exploitFix available EPSS 77.8% 8.8 HighAugust 10, 2017
git Red Hat git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x... CVE-2017-8386 Public exploitFix available EPSS 12.4% 8.8 HighMay 10, 2017
git Red Hat contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1... CVE-2014-9938 Fix available 8.8 HighMarch 19, 2017
git Red Hat revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers... CVE-2016-2315 Fix available EPSS 17.3% 9.8 CriticalMarch 16, 2016
git Red Hat Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1)... CVE-2016-2324 Fix available EPSS 18.1% 9.8 CriticalMarch 15, 2016
git Red Hat The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4... CVE-2015-7545 Public exploitFix available EPSS 18.7% 9.8 CriticalDecember 9, 2015
git Red Hat The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a... CVE-2013-0308 Fix available 4.3 MediumMarch 8, 2013
git Red Hat Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to... CVE-2010-3906 Public exploitFix available 4.3 MediumDecember 17, 2010