CVE-2024-50349 Details
Description
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
A vulnerability in Git's credential handling can mislead users into providing sensitive information, such as passwords, for trusted Git hosting sites. This occurs when Git prompts for credentials in the terminal without using a credential helper. The vulnerability is present in Git versions 2.48.0 through 2.47.1, 2.46.2 through 2.45.2, 2.44.2, 2.43.5, 2.42.3, 2.41.2, and 2.40.3. During the credential prompt, Git prints the host name with any URL-encoded parts decoded, allowing attackers to craft URLs with ANSI escape sequences. These sequences can confuse users into sending passwords to untrusted sites under the attacker's control.
Users should upgrade to Git versions 2.48.1, 2.47.2, 2.46.3, 2.45.3, 2.44.3, 2.43.6, 2.42.4, 2.41.3, or 2.40.4. For those unable to upgrade, it is advised to avoid cloning from untrusted URLs, especially when recursive clones are involved.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html | CVE | Mailing ListThird Party Advisory |
| https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8 | [email protected] | Patch |
| https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577 | [email protected] | Patch |
| https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-147 | Improper Neutralization of Input Terminators | [email protected] |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| debian debian linux | 11.0 |
CPE
Remediation
| |
| git git | < 2.40.4 >= 2.41.0, < 2.41.3 >= 2.42.0, < 2.42.4 >= 2.43.0, < 2.43.6 >= 2.44.3, < 2.44.3 >= 2.45.3, < 2.45.3 >= 2.46.3, < 2.46.3 >= 2.47.0, < 2.47.2 2.48.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 18, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jan 21, 2025 | CVE Modified | [email protected] |
| Jan 14, 2025 | New CVE Received | [email protected] |