Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-52005 EUVD-2024-46250

The sideband payload is passed unfiltered to the terminal in git

Published Jan 15, 2025 · Updated Jan 15, 2025 · Assigned by GitHub_M

Vendor: git Product: git Package: git Package: git Package: git Package: git-email Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

Affected products

VendorProductAffectedFixed
git git >= 2.48.0, <= 2.48.1, >= 2.47.0, <= 2.47.1, >= 2.46.0, <= 2.46.3, >= 2.45.0, <= 2.45.3, >= 2.44.0, <= 2.44.3, >= 2.43.0, <= 2.43.6, >= 2.42.0, <= 2.42.4, >= 2.41.0, <= 2.41.3, <= 2.40.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 git No fix yet —
Debian 13 git No fix yet —
Debian 12 git No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 git No fix yet —
Ubuntu 26.04 LTS git No fix yet —
Ubuntu 25.10 git No fix yet —
Ubuntu 24.04 LTS git No fix yet —
Ubuntu 22.04 LTS git No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS git No fix yet —
Ubuntu Pro 18.04 LTS git No fix yet —
Ubuntu Pro 16.04 LTS git No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 git +14 2.47.1-2.el10_0 RHSA-2025:7482
RHEL 9 git +14 2.47.1-2.el9_6 RHSA-2025:7409
RHEL 8 git +14 2.43.5-3.el8_10 RHSA-2025:8414
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS git +14 2.43.5-1.el9_4.1 RHSA-2025:7640
RHEL 9.2 EUS git +14 2.39.5-1.el9_2.1 RHSA-2025:7641

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 git +14 2.47.1-2.el10_0 ALSA-2025:7482
AlmaLinux 9 git +14 2.47.1-2.el9_6 ALSA-2025:7409
AlmaLinux 8 git +14 2.43.5-3.el8_10 ALSA-2025:8414

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 git 2.47.1-2.el10_0 RLSA-2025:7482
Rocky Linux 9 git 2.47.1-2.el9_6 RLSA-2025:7409
Rocky Linux 8 git 2.43.5-3.el8_10 RLSA-2025:8414

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 git +16 2.47.1-1.amzn2023.0.3 ALAS2023-2025-1014
Amazon Linux 2 git +16 2.47.1-1.amzn2.0.3 ALAS2-2025-2884

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 git No fix yet —
Azure Linux 2 (CBL-Mariner) git No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 git +14 2.47.1-2.el10_0 ELSA-2025-7482
Oracle Linux 9 git +14 2.47.1-2.el9_6 ELSA-2025-7409
Oracle Linux 8 git +14 2.43.5-3.el8_10 ELSA-2025-8414

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling git-email 2.49.0-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • andrewd-cg/cve-2024-52005-poc ★ 0 · Dec 29, 2025

    Proof-of-Concept for CVE-2024-52005: ANSI escape sequence injection in Git. Demonstrates incorrect 'not_affected' VEX claims in hardened container images.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 17

References