Red Hat Security Advisory: git security update

Fixed packages 20

Vulnerabilities 7

• High 8.1
  CVE-2025-48384 Exploited Public exploit

  Git allows arbitrary code execution through broken config quoting

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). W…

  git git git git Debian Ubuntu Azure Linux Alpine
  Jul 8, 2025

  KEV Aug 25, 2025
• High 8.6
  CVE-2025-27614

  Gitk allows arbitrary command execution

  Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ..…

  j6t gitk git git Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 8.6
  CVE-2025-48385

  Git alllows arbitrary file writes via bundle-uri parameter injection

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote se…

  git git git git Debian Ubuntu Azure Linux Alpine
  Jul 8, 2025
• High 8.5
  CVE-2025-46835

  Git GUI can create and overwrite files for which the user has write permission

  Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files …

  j6t git-gui git git Debian Ubuntu Alpine
  Jul 10, 2025
• Low 3.6
  CVE-2025-27613

  Gitk can create and truncate files in the user's home directory

  Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-…

  j6t gitk git git Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• Low 2.1
  CVE-2024-50349

  Git does not sanitize URLs when asking for credentials interactively

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helpe…

  git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 14, 2025
• Low 2.1
  CVE-2024-52006

  Newline confusion in credential helpers can lead to credential exfiltration in git

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git c…

  git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 14, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2337824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2337956
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2378806
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2378808
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379326
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11533.json
• report
  https://access.redhat.com/security/cve/CVE-2024-50349
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50349
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50349
• article
  https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8
• article
  https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577
• article
  https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr
• report
  https://access.redhat.com/security/cve/CVE-2024-52006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-52006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-52006
• article
  https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g
• article
  https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060
• article
  https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
• article
  https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp
• report
  https://access.redhat.com/security/cve/CVE-2025-27613
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-27613
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-27613
• article
  https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v
• article
  https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/
• article
  https://www.openwall.com/lists/oss-security/2025/07/08/4
• report
  https://access.redhat.com/security/cve/CVE-2025-27614
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-27614
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-27614
• report
  https://access.redhat.com/security/cve/CVE-2025-46835
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-46835
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-46835
• article
  https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da
• article
  https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg
• report
  https://access.redhat.com/security/cve/CVE-2025-48384
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-48384
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-48384