Critical Security Update for Git: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:11533: Important: git security update. Affects git versions < 2.47.3-1.el10_0. Fixed in 2.47.3-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system that allows users to track changes in source code during software development. It operates on a decentralized architecture, enabling each user to have a complete copy of the repository with full revision history. This functionality allows for offline work and collaboration without needing direct access to a central server. However, recent vulnerabilities have been identified that could compromise the security of Git and its associated tools.
Vulnerability Detail
The vulnerabilities in Git stem from various issues, including improper sanitization of URLs when requesting credentials, newline confusion in credential helpers, and arbitrary code execution risks. These vulnerabilities can lead to credential exfiltration, unauthorized file writes, and potential execution of malicious scripts. Specifically, CVE-2024-50349 highlights the lack of URL sanitization, while CVE-2025-48384 and CVE-2025-48385 detail risks of arbitrary code execution and file manipulation, respectively. The implications of these vulnerabilities are significant, as they could allow attackers to gain unauthorized access to sensitive information or execute harmful code within the user's environment.
How To Fix
Minimum fixed version
2.47.3-1.el10_0
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of Git that involve credential handling until the update is applied. Additionally, users should be cautious about the URLs they interact with and avoid executing scripts from untrusted sources.
Conclusion
In summary, the recent vulnerabilities identified in Git pose significant risks to users and their projects. It is crucial to update to the patched version 2.47.3-1.el10_0 to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for git →
FAQ
The main vulnerabilities include improper URL sanitization, newline confusion in credential helpers, arbitrary code execution, and unauthorized file writes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
If you cannot update Git right away, avoid using features that handle credentials and be cautious with untrusted URLs and scripts.
CVE identifiers are unique references for publicly known cybersecurity vulnerabilities. They help in tracking and addressing specific security issues.
Yes, there is a risk of data loss or unauthorized access to sensitive information if these vulnerabilities are exploited.
Related vulnerabilities
Recent vulnerabilities recorded for git.
