This advisory covers two security vulnerabilities in Git distributed with Red Hat Enterprise Linux 8.8 and related variants. CVE-2025-48384 enables arbitrary code execution, while CVE-2025-48385 allows arbitrary file writes. Both vulnerabilities pose significant risks by potentially allowing attackers to execute code or modify files without authorization. Red Hat has released updated Git packages (version 2.39.5-1.el8_8.2) that address these issues. The advisory references Red Hat's errata RHSA-2025:11794 and provides detailed package information for remediation.

Successful exploitation of CVE-2025-48384 could allow an attacker to execute arbitrary code on affected systems, potentially leading to full system compromise. CVE-2025-48385 could allow unauthorized arbitrary file writes, which might be leveraged to alter system or application files, leading to further compromise or disruption. The vulnerabilities affect multiple Red Hat Enterprise Linux 8.8 variants, impacting systems using Git for version control. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Git packages that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:11794 and the related article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated.