Critical Vulnerability in Git: Incomplete Protections Against Carriage Return Exploits
Summary
CVE-2024-52006: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Affects git across 2 version ranges.
< 2.40.4-r0
< b01b9b81d36759cdcd07305e78765199e1bc2060
Fixed in 2.40.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used, fast, and scalable distributed revision control system that allows developers to manage and track changes in their codebase efficiently. It features a rich command set that provides both high-level operations and direct access to its internals. However, certain ecosystems, particularly .NET and node.js, misinterpret single Carriage Return characters as newlines, leading to vulnerabilities in credential helpers. This specific issue compromises the protections established against CVE-2020-5260.
Vulnerability Detail
The vulnerability arises from the way Git interacts with credential helpers in ecosystems that misinterpret Carriage Return characters. This flaw can lead to unauthorized access or manipulation of sensitive information, as the protections against CVE-2020-5260 are rendered incomplete. The issue has been addressed in specific commits, but users must ensure they are using the patched versions to mitigate the risk.
How To Fix
Minimum fixed version
2.40.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, users are advised to avoid cloning from untrusted URLs, especially when performing recursive clones, to minimize the risk of exploitation.
Conclusion
CVE-2024-52006 presents a significant vulnerability in Git that can lead to unauthorized access due to improper handling of Carriage Return characters by credential helpers. Users are strongly advised to upgrade to the patched versions of Git to ensure their systems are secure.
See every vulnerability recorded for git →
FAQ
CVE-2024-52006 is a vulnerability in Git that affects how credential helpers interpret Carriage Return characters, potentially leading to unauthorized access.
If you are using a version of Git prior to v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, or v2.40.4, your installation is likely affected.
If you cannot upgrade, avoid cloning from untrusted URLs and be cautious with recursive clones to reduce the risk of exploitation.
More information can be found in the official Git release notes and security advisories related to CVE-2024-52006.
Vulert monitors and alerts for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for git.
