Skip to content
OpenAdvisories
High 1 exploited CVE ALSA-2025:11462 7 CVEs

Important: git security update

Published Jul 21, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)
* git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)
* git: Git arbitrary code execution (CVE-2025-48384)
* git: Git arbitrary file writes (CVE-2025-48385)
* gitk: Git file creation flaw (CVE-2025-27613)
* gitk: git script execution flaw (CVE-2025-27614)
* git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 15

ReleasePackageFixed in
AlmaLinux · 9 git 2.47.3-1.el9_6
AlmaLinux · 9 git-all 2.47.3-1.el9_6
AlmaLinux · 9 git-core 2.47.3-1.el9_6
AlmaLinux · 9 git-core-doc 2.47.3-1.el9_6
AlmaLinux · 9 git-credential-libsecret 2.47.3-1.el9_6
AlmaLinux · 9 git-daemon 2.47.3-1.el9_6
AlmaLinux · 9 git-email 2.47.3-1.el9_6
AlmaLinux · 9 git-gui 2.47.3-1.el9_6
AlmaLinux · 9 git-instaweb 2.47.3-1.el9_6
AlmaLinux · 9 git-subtree 2.47.3-1.el9_6
AlmaLinux · 9 git-svn 2.47.3-1.el9_6
AlmaLinux · 9 gitk 2.47.3-1.el9_6
AlmaLinux · 9 gitweb 2.47.3-1.el9_6
AlmaLinux · 9 perl-Git 2.47.3-1.el9_6
AlmaLinux · 9 perl-Git-SVN 2.47.3-1.el9_6

Vulnerabilities 7

  • High 8.1
    CVE-2025-48384 Exploited Public exploit

    Git allows arbitrary code execution through broken config quoting

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). W…

    git git git git Debian Ubuntu Azure Linux Alpine
    KEV Aug 25, 2025
  • High 8.6
    CVE-2025-27614

    Gitk allows arbitrary command execution

    Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ..…

    j6t gitk git git Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2025-48385

    Git alllows arbitrary file writes via bundle-uri parameter injection

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote se…

    git git git git Debian Ubuntu Azure Linux Alpine
  • High 8.5
    CVE-2025-46835

    Git GUI can create and overwrite files for which the user has write permission

    Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files …

    j6t git-gui git git Debian Ubuntu Alpine
  • Low 3.6
    CVE-2025-27613

    Gitk can create and truncate files in the user's home directory

    Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-…

    j6t gitk git git Debian Ubuntu Azure Linux Alpine
  • Low 2.1
    CVE-2024-50349

    Git does not sanitize URLs when asking for credentials interactively

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helpe…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 2.1
    CVE-2024-52006

    Newline confusion in credential helpers can lead to credential exfiltration in git

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git c…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-50349
  • report
    https://access.redhat.com/security/cve/CVE-2024-52006
  • report
    https://access.redhat.com/security/cve/CVE-2025-27613
  • report
    https://access.redhat.com/security/cve/CVE-2025-27614
  • report
    https://access.redhat.com/security/cve/CVE-2025-46835
  • report
    https://access.redhat.com/security/cve/CVE-2025-48384
  • report
    https://access.redhat.com/security/cve/CVE-2025-48385
  • report
    https://bugzilla.redhat.com/2337824
  • report
    https://bugzilla.redhat.com/2337956
  • report
    https://bugzilla.redhat.com/2378806
  • report
    https://bugzilla.redhat.com/2378808
  • report
    https://bugzilla.redhat.com/2379124
  • report
    https://bugzilla.redhat.com/2379125
  • report
    https://bugzilla.redhat.com/2379326
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-11462.html