Git GUI contains a vulnerability where cloning an untrusted repository and editing a file in a maliciously named directory can cause Git GUI to create or overwrite files for which the user has write permission. This issue affects versions from 1.6.3.1 up to but not including 2.25.0_1 and is fixed in later versions starting from 2.25.0_1. The vulnerability has a high severity with a CVSS score of 8.5.
Git versions from 2.38.0 up to but not including 2.50.1 contain a vulnerability where the client does not sufficiently validate advertised bundles during cloning. This allows a malicious remote server to perform protocol injection via the bundle-uri parameter, potentially causing arbitrary file writes to locations controlled by the attacker. The vulnerability can lead to arbitrary code execution in the worst case. The use of bundle URIs is disabled by default and can be controlled by configuration. Some attack scenarios require control over the clone destination or recursive cloning, which can be mitigated by disabling recursive clones. The issue is fixed in Git version 2.50.1 and later.
A vulnerability in Git allows arbitrary code execution due to improper handling of trailing carriage return characters in configuration values. Specifically, when initializing a submodule with a path containing a trailing CR, the altered path may cause the submodule to be checked out to an incorrect location. If a symlink points this altered path to the submodule hooks directory and the submodule contains an executable post-checkout hook, the hook script may be executed unintentionally. This flaw is fixed in Git versions 2.50.1 and later.
Gitk, a Git history browser, has a vulnerability that allows creation and truncation of files in the user's home directory when running gitk on an untrusted repository under certain conditions. This occurs if the 'Support per-file encoding' option was previously enabled or when using the 'Show origin of this line' feature. The issue affects versions starting from 1.7.0 up to but not including 2.25.0_1 and is fixed in later versions.
A vulnerability in Git's credential helper protocol allows credential exfiltration due to newline confusion caused by certain ecosystems interpreting carriage return characters as newlines. This issue affects Git versions from 1.7.9 up to but not including 2.48.1. The vulnerability has been fixed in Git version 2.48.1 and several other patch releases. Users are advised to upgrade to a fixed version or avoid cloning from untrusted URLs, especially recursive clones.
CVE-2024-52005 is a high-severity vulnerability in Git where informational or error messages sent from a remote Git server during clone, fetch, or push operations are passed unfiltered to the terminal via the sideband channel. These messages, prefixed with "remote:", are printed directly to standard error without sanitization of ANSI escape sequences. Malicious actors can exploit this to manipulate terminal output, potentially misleading users or hiding information. The issue affects Git versions from 1.6.3.1 up to but not including 2.55.0. A fix is available in Git 2.55.0. Users are advised to update promptly or avoid recursive clones from untrusted sources if they cannot upgrade.
Git versions prior to 2.48.1 do not sanitize URLs when prompting for credentials interactively in the terminal. This allows attackers to craft URLs containing ANSI escape sequences that can manipulate terminal output, potentially misleading users into providing credentials to malicious sites. The issue has been fixed in Git version 2.48.1 and later. Users are advised to upgrade to these fixed versions or avoid cloning from untrusted URLs, especially recursive clones.
Git contains a vulnerability (CVE-2024-32465) that allows bypassing protections designed to safely clone untrusted repositories. This issue affects Git versions from 2.17.0 up to but not including 2.45.1. The vulnerability can lead to execution of malicious hooks or other harmful actions when cloning repositories obtained from untrusted sources, such as archives. The problem has been addressed in Git version 2.45.1 and several earlier patch releases. Users are advised to avoid using Git in repositories obtained via archives from untrusted sources as a temporary mitigation.
A vulnerability in Git prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 allows local cloning of repositories containing symlinks to create hardlinks to arbitrary user-readable files on the same filesystem in the new repository's objects directory. This occurs due to a race condition in the check for symlinks during the hardlink operation. The issue has been patched in the stated versions.
A vulnerability in Git prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 allows an untrusted user to modify objects in a cloned local repository. This occurs because local clones on the same disk may hardlink files from the source repository's object database, which remain owned by the original user and can be altered by them. The issue has been fixed in version 2.45.1 and related releases.
A remote code execution vulnerability exists in Git when cloning specially crafted local repositories. Versions prior to 2.45.1 are affected. An attacker can create a malicious repository that executes arbitrary code during the clone operation. This issue has been patched in version 2.45.1. Users are advised to avoid cloning repositories from untrusted sources as a workaround.
Git versions prior to 2.45.1 contain a vulnerability in recursive clones on case-insensitive filesystems with symlink support enabled. Crafted repositories with submodules can exploit a bug causing Git to write files into the .git/ directory instead of the submodule worktree. This allows an attacker to write and execute malicious hooks during the clone operation without user inspection. The issue is patched in version 2.45.1 and later. Disabling symbolic link support in Git prevents this attack.