Credential Exposure Vulnerability in Git Package
Summary
CVE-2024-50349: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Affects git across 3 version ranges.
< 2.40.4-r0
< 7725b8100ffbbff2750ee4d61a0fcc1f53a086e8
< c903985bf7e772e2d08275c1a95c8a55ab011577
Fixed in 2.40.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used distributed version control system that allows developers to track changes in source code during software development. It is known for its speed, scalability, and rich command set, which provides both high-level operations and full access to its internals. However, Git has a vulnerability that can expose user credentials when prompted for authentication via a terminal, particularly when using untrusted URLs.
Vulnerability Detail
The vulnerability, identified as CVE-2024-50349, arises when Git requests credentials through a terminal prompt without utilizing a credential helper. During this process, Git prints the host name for which the user is expected to provide a username and/or password. Attackers can exploit this by crafting URLs containing ANSI escape sequences, misleading users into entering their credentials for trusted Git hosting sites, while the credentials are actually sent to untrusted sites controlled by the attacker. This vulnerability affects multiple versions of Git across various Debian ecosystems.
How To Fix
Minimum fixed version
2.40.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If users are unable to upgrade Git, they should avoid cloning from untrusted URLs, especially when performing recursive clones. This can help mitigate the risk of credential exposure until an upgrade is possible.
Conclusion
CVE-2024-50349 is a significant vulnerability in the Git package that can lead to credential exposure through misleading terminal prompts. Users are strongly advised to upgrade to the patched versions of Git to protect against this vulnerability. Until an upgrade is feasible, avoiding untrusted URLs is a crucial workaround.
See every vulnerability recorded for git →
FAQ
CVE-2024-50349 is a vulnerability in Git that allows attackers to mislead users into providing their credentials through manipulated terminal prompts.
Any version of Git prior to the patched releases mentioned in the 'how_to_fix' section is potentially affected by this vulnerability.
If an upgrade is not possible, avoid using untrusted URLs for cloning repositories, especially recursive clones.
The vulnerability can trick users into entering their credentials for a trusted site, which are then sent to an untrusted site controlled by an attacker.
More information can be found in the official Git release notes and security advisories related to CVE-2024-50349.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
