Corrective releases of the distributed version control system Git 2.41.3, 2.42.4, 2.43.6, 2.44.3, 2.45.3, 2.46.3, v2.47.2, and 2.48.1 have been published, addressing two vulnerabilities:
- CVE-2024-50349 — the possibility of tampering with information in an interactive password prompt to a repository. The issue is caused by insufficient verification of the host name, which allowed character encoding in the %xx format (URL Encoding). An attacker could use percent encoding to inject escape sequences into the host name that manipulate the terminal output.
In this way, the text of the authentication prompt can be replaced, creating the illusion for the user that they are addressing another repository. When accessing the attacker's repository, the user could unknowingly enter their login and password for another host. The attack can be performed while recursively cloning submodules using the command 'git clone --recurse-submodules', where one of the submodules may request a password for another host, but the input will be sent to the attacker's repository.
- CVE-2024-52006 — a flaw in the implementation of the 'credential helper' protocol, used to pass credentials when accessing repositories with restricted access, allows for inserting a carriage return character in the data by specifying a specially crafted URL. Since the protocol manipulates line-by-line data, adding a carriage return can be used to separate data blocks and organize the transmission of a password to the wrong location. serverThe potential for an attack depends on the interpretation of the carriage return character as a line delimiter in various implementations of the 'credential helper' protocol. For example, the Git Credential Manager, written in C#/.NET, is susceptible to this issue.
Users who cannot update Git are advised to refrain from accessing untrusted external repositories using the 'git clone' command with the '--recurse-submodules' flag, and to avoid using credential helpers when cloning public repositories. In addition to Git itself, fixes to block these vulnerabilities have been released for GitHub Desktop (CVE-2025-23040), Git LFS (CVE-2024-53263), and Git Credential Manager (CVE-2024-50338).
Source: opennet.ru
