Critical Security Update for Git Package: CVE-2024-50349
Summary
RHSA-2025:19601: Red Hat Security Advisory: git security update. Affects git versions < 0:2.43.5-1.el9_4.3. Fixed in 0:2.43.5-1.el9_4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, efficiency, and support for distributed, non-linear workflows. The Git package is essential for managing code repositories and collaborating on projects. However, a recent vulnerability has been identified that could potentially compromise the security of systems using this package.
Vulnerability Detail
The vulnerability identified as CVE-2024-50349 affects multiple components of the Git package, including git, git-all, and git-core. This issue arises from improper handling of certain inputs, which could allow an attacker to exploit the system. The potential ramifications include unauthorized access to sensitive data and disruption of service. The vulnerability has a CVSS score of 3.1, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:2.43.5-1.el9_4.3
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Git service or disabling it temporarily until the update can be applied. Additionally, monitor logs for any suspicious activity that may indicate exploitation attempts.
Conclusion
The Git package has a critical vulnerability (CVE-2024-50349) that requires immediate attention. Users are advised to update their packages to the patched version to mitigate potential risks. For those unable to update right away, implementing workarounds and monitoring for suspicious activity is recommended.
See every vulnerability recorded for git →
FAQ
CVE-2024-50349 is a security vulnerability affecting the Git package that could allow unauthorized access and disruption of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider restricting access to the Git service and monitoring for suspicious activity.
The CVSS score of this vulnerability is 3.1, indicating a moderate level of risk.
For more information on vulnerabilities, you can visit Vulert at https://vulert.com, which monitors and alerts for open-source vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for git.
