Threats Tagged 'cve-2025-27614'

Multiple security vulnerabilities have been identified and addressed in Git and related components distributed with Red Hat Enterprise Linux 9. These include issues such as improper sanitization of URLs when requesting credentials, newline confusion in credential helpers leading to potential credential exfiltration, arbitrary code execution, arbitrary file writes, and file creation and script execution flaws in gitk and Git GUI. The update addresses seven CVEs affecting Git and gitk, rated as important by Red Hat Product Security. The advisory provides updated packages to remediate these vulnerabilities.

Multiple security vulnerabilities have been identified in Git and related components affecting Red Hat Enterprise Linux 10. These include issues such as improper sanitization of URLs when requesting credentials, newline confusion in credential helpers leading to potential credential exfiltration, arbitrary code execution, arbitrary file writes, and file creation and script execution flaws in gitk and Git GUI. The vulnerabilities collectively pose risks of credential leakage, unauthorized code execution, and unauthorized file modifications. Red Hat has issued an important security advisory with updates to address these issues.

This Red Hat security advisory addresses multiple vulnerabilities in Git and gitk affecting Red Hat Enterprise Linux 8. The issues include improper sanitization of URLs when requesting credentials, newline confusion leading to credential exfiltration, arbitrary code execution, arbitrary file writes, file creation flaws, script execution flaws, and the ability of Git GUI to create or overwrite files with user write permissions. These vulnerabilities collectively pose risks such as credential leakage, unauthorized code execution, and unauthorized file manipulation. Red Hat has released updated packages to fix these issues for affected versions of Git. Users of Red Hat Enterprise Linux 8 are advised to apply the provided security update to mitigate these vulnerabilities. No known exploits in the wild have been reported at this time.

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-27614#cwe-78