{"id":82019,"date":"2025-01-14T10:04:36","date_gmt":"2025-01-14T18:04:36","guid":{"rendered":"https:\/\/github.blog\/?p=82019"},"modified":"2025-01-15T11:47:46","modified_gmt":"2025-01-15T19:47:46","slug":"git-security-vulnerabilities-announced-5","status":"publish","type":"post","link":"https:\/\/github.blog\/open-source\/git\/git-security-vulnerabilities-announced-5\/","title":{"rendered":"Git security vulnerabilities announced"},"content":{"rendered":"\n

Today, the Git project released new versions<\/a> to address a pair of security vulnerabilities, CVE-2024-50349<\/a> and CVE-2024-52006<\/a>, that affect all prior versions of Git.<\/p>\n

CVE-2024-50349<\/span><\/a><\/h2>\n

When Git needs to fill in credentials interactively without the use of a credential helper<\/a>, it prints out the hostname and asks the user to fill in the appropriate username\/password pair for that host. However, Git prints out the hostname after URL-decoding<\/a> it. This allows an attacker to craft URLs containing ANSI escape sequences<\/a> that may be used to construct an intentionally misleading prompt. The attacker may then tweak the prompt to trick a user into providing credentials for a different Git host back to the attacker.<\/p>\n

[source<\/a>]<\/p>\n

CVE-2024-52006<\/span><\/a><\/h2>\n

When using a credential helper (as opposed to asking the user for their credentials interactively as above), Git uses a line-based protocol<\/a> to pass information between itself and the credential helper. A specially-crafted URL containing a carriage return<\/a> can be used to inject unintended values into the protocol stream, causing the helper to retrieve the password for one server while sending it to another.<\/p>\n

This vulnerability is related to CVE-2020-5260<\/a>, but relies on behavior where single carriage return characters are interpreted by some credential helper implementations as newlines.<\/p>\n

[source<\/a>]<\/p>\n

Upgrade to the latest Git version<\/span><\/a><\/h2>\n

The most effective way to protect against these vulnerabilities is to upgrade to Git 2.48.1. If you can’t upgrade immediately, reduce your risk by taking the following steps:<\/p>\n