Critical Security Flaw in Git Package: Credential Exposure via Terminal Prompts
Summary
ALPINE-CVE-2024-50349: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Affects git versions < 2.40.4-r0. Fixed in 2.40.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used, fast, and scalable distributed revision control system that provides a rich command set for managing source code. It allows users to track changes, collaborate on projects, and maintain version history. However, a recent vulnerability has been identified that compromises user credentials when interacting with untrusted URLs, posing significant security risks.
Vulnerability Detail
The vulnerability arises when Git prompts users for credentials via a terminal without using a credential helper. During this process, Git prints the hostname for which credentials are required, and any URL-encoded parts are decoded and displayed verbatim. Attackers can exploit this by crafting URLs containing ANSI escape sequences, misleading users into entering their credentials for trusted Git hosting sites, while the credentials are actually sent to malicious sites controlled by the attackers. This flaw has been addressed in several patched versions of Git.
How To Fix
Minimum fixed version
2.40.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until the package can be updated, users are advised to avoid cloning from untrusted URLs, especially when performing recursive clones. This can help mitigate the risk of credential exposure.
Conclusion
The identified vulnerability in the Git package poses a significant risk by exposing user credentials through misleading terminal prompts. Users are strongly encouraged to update their Git installations to the latest patched versions to safeguard against potential attacks. Additionally, exercising caution when interacting with untrusted URLs can help mitigate risks until an upgrade is possible.
See every vulnerability recorded for git →
FAQ
The vulnerability allows attackers to craft misleading URLs that can trick users into providing their credentials for untrusted sites.
Check your Git version using the command 'git --version'. If it is lower than the patched versions listed, it is vulnerable.
Avoid cloning from untrusted URLs and be cautious when entering credentials in the terminal.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using just a manifest file.
You can find detailed information about this vulnerability in the CVE database or by visiting the official Git repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
