Critical Security Vulnerabilities in Git Package - Update Required
Summary
RLSA-2025:11462: Important: git security update. Affects git versions < 0:2.47.3-1.el9_6. Fixed in 0:2.47.3-1.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system that allows multiple users to work on projects simultaneously without needing a centralized server. It maintains a complete history of changes, enabling offline work and collaboration. However, recent vulnerabilities have been identified that could compromise the security of Git repositories.
Vulnerability Detail
The vulnerabilities in Git stem from improper handling of URLs and credential management, leading to potential credential exfiltration and arbitrary code execution. Specifically, issues such as un-sanitized URLs during credential prompts (CVE-2024-50349) and newline confusion in credential helpers (CVE-2024-52006) can expose sensitive information. Additionally, arbitrary file writes and code execution vulnerabilities (CVE-2025-48384, CVE-2025-48385) pose significant risks, allowing attackers to manipulate files or execute malicious scripts. The CVSS score for these vulnerabilities is 8.3, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.47.3-1.el9_6
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using Git in environments where sensitive credentials are handled. Additionally, consider using alternative credential storage methods that do not rely on Git's credential helpers until the update is applied.
Conclusion
In summary, several critical vulnerabilities have been identified in the Git package that could lead to significant security risks. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git →
FAQ
The main vulnerabilities include improper URL sanitization, newline confusion in credential helpers, arbitrary code execution, and arbitrary file writes.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for the vulnerabilities in Git is 8.3, indicating a high severity level.
If an immediate update is not possible, avoid using Git in sensitive environments and consider alternative credential management methods.
The Rocky Enterprise Software Foundation and Red Hat are credited with addressing these vulnerabilities and providing the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
