Critical Security Update for Git: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:11534: Important: git security update. Affects git versions < 2.43.7-1.el8_10. Fixed in 2.43.7-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system that allows users to track changes in source code during software development. It features a decentralized architecture, enabling each working copy of a Git repository to have a complete revision history. This design allows users to work offline and collaborate without needing direct access to a central server. However, recent vulnerabilities have been identified that could compromise the security of Git and its associated tools.
Vulnerability Detail
The vulnerabilities identified in Git include improper sanitization of URLs when requesting credentials, which could lead to credential exposure (CVE-2024-50349). Additionally, newline confusion in credential helpers may result in credential exfiltration (CVE-2024-52006). Other critical issues involve arbitrary code execution (CVE-2025-48384) and arbitrary file writes (CVE-2025-48385). Gitk also has vulnerabilities that allow for file creation flaws (CVE-2025-27613) and script execution flaws (CVE-2025-27614). Furthermore, the Git GUI can create and overwrite files that the user has permission to write (CVE-2025-46835). These vulnerabilities pose significant risks, including unauthorized access to sensitive data and potential system compromise.
How To Fix
Minimum fixed version
2.43.7-1.el8_10
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using Git in environments where sensitive credentials are handled until the update is applied. Additionally, consider using alternative credential management tools that do not expose credentials in an insecure manner.
Conclusion
In summary, the recent vulnerabilities in Git pose serious security risks that can lead to unauthorized access and data exposure. It is crucial for users to update their Git installations to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for git →
FAQ
The main vulnerabilities include improper URL sanitization, newline confusion in credential helpers, arbitrary code execution, and file creation flaws.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, avoid using Git for sensitive operations and consider using alternative credential management solutions.
Yes, you can update Git and its related packages using the command: 'sudo dnf update git git-all git-core git-core-doc git-credential-libsecret git-daemon git-email git-gui git-instaweb git-subtree git-svn gitk gitweb perl-Git perl-Git-SVN'.
Vulert is a tool that monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. It provides real-time alerts for any vulnerabilities detected.
Related vulnerabilities
Recent vulnerabilities recorded for git.
