Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

An update of the git package has been released.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4031 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4031-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     January 28, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : git     Version        : 1:2.30.2-1+deb11u4     CVE ID         : CVE-2024-50349 CVE-2024-52006     Debian Bug     : 1093042

    Multiple vulnerabilities were discovered in git, a fast, scalable and     distributed revision control system.

    CVE-2024-50349

        When Git asks for credentials via a terminal prompt (i.e. without         using any credential helper), it prints out the host name for which         the user is expected to provide a username and/or a password.  At         this stage, any URL-encoded parts have been decoded already, and are         printed verbatim.  This could allow attackers to craft URLs that         contain ANSI escape sequences that the terminal interpret to confuse         users e.g. into providing passwords for trusted Git hosting sites         when in fact they are then sent to untrusted sites that are under         the attacker's control.

    CVE-2024-52006

        Git defines a line-based protocol that is used to exchange         information between Git and Git credential helpers.  Some ecosystems         (most notably, .NET and node.js) interpret single Carriage Return         characters as newlines, which renders the protections against         CVE-2020-5260 incomplete for credential helpers that treat Carriage         Returns in this way.

    For Debian 11 bullseye, these problems have been fixed in version     1:2.30.2-1+deb11u4.

    We recommend that you upgrade your git packages.

    For the detailed security status of git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5850 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5850-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     January 26, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : git     CVE ID         : CVE-2024-50349 CVE-2024-52006     Debian Bug     : 1093042

    Multiple issues were found in Git, a fast, scalable, distributed     revision control system, which may result in leaking credential     information to an unintended host.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:2.39.5-0+deb12u2.

    We recommend that you upgrade your git packages.

    For the detailed security status of git please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/git

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-815 advisory.

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. When Git asks for credentials via a     terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user     is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been     decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape     sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git     hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits `7725b81` and `c903985` which are included in release versions     v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to     upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
    (CVE-2024-50349)

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. Git defines a line-based protocol that     is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably,     .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections     against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This     issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1,     v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users     unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. (CVE-2024-52006)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.47.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2737 advisory.

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. When Git asks for credentials via a     terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user     is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been     decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape     sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git     hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits `7725b81` and `c903985` which are included in release versions     v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to     upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
    (CVE-2024-50349)

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. Git defines a line-based protocol that     is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably,     .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections     against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This     issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1,     v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users     unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. (CVE-2024-52006)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50349 advisory.

  - Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. When Git asks for credentials via a     terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user     is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been     decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape     sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git     hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits `7725b81` and `c903985` which are included in release versions     v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to     upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
    (CVE-2024-50349)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0197-1 advisory.

    - CVE-2024-32002: Fix recursive clones on case-insensitive filesystems that support symbolic links are     susceptible to case confusion. (bsc#1224168)
    - CVE-2024-32004: Fixed arbitrary code execution during local clones. (bsc#1224170)
    - CVE-2024-32020: Fix file overwriting vulnerability during local clones. (bsc#1224171)
    - CVE-2024-32021: Git may create hardlinks to arbitrary user-readable files. (bsc#1224172)
    - CVE-2024-32465: Fixed arbitrary code execution during clone operations. (bsc#1224173)
    - CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
    - CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0144-1 advisory.

    - CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
    - CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0116-1 advisory.

    - CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
    - CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.46.3 / 2.48.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-015-01 advisory.

    New git packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the git security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8 advisory.

    Git development team reports:
    CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the               user susceptible to crafted URLs (e.g. in recursive clones) that               mislead the user into typing in passwords for trusted sites that               would then be sent to untrusted sites instead.
    CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to               credential helpers which use line-reading functions that               interpret said Carriage Returns as line endings, even though Git               did not intend that.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7207-1 advisory.

    It was discovered that Git incorrectly handled certain URLs when asking for credentials. An attacker could     possibly use this issue to mislead the user into typing passwords for trusted sites that would then be     sent to untrusted sites instead. (CVE-2024-50349)

    It was discovered that git incorrectly handled line endings when using credential helpers.
    (CVE-2024-52006)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216580	Photon OS 4.0: Git PHSA-2025-4.0-0756	Nessus	PhotonOS Local Security Checks	low
214705	Debian dla-4031 : git - security update	Nessus	Debian Local Security Checks	low
214652	Debian dsa-5850 : git - security update	Nessus	Debian Local Security Checks	low
214628	Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2025-815)	Nessus	Amazon Linux Local Security Checks	low
214610	Amazon Linux 2 : git (ALAS-2025-2737)	Nessus	Amazon Linux Local Security Checks	low
214490	CBL Mariner 2.0 Security Update: git (CVE-2024-50349)	Nessus	MarinerOS Local Security Checks	low
214460	SUSE SLES12 Security Update : git (SUSE-SU-2025:0197-1)	Nessus	SuSE Local Security Checks	low
214294	SUSE SLES15 Security Update : git (SUSE-SU-2025:0144-1)	Nessus	SuSE Local Security Checks	low
214254	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : git (SUSE-SU-2025:0116-1)	Nessus	SuSE Local Security Checks	low
214240	Slackware Linux 15.0 / current git Multiple Vulnerabilities (SSA:2025-015-01)	Nessus	Slackware Local Security Checks	low
214219	FreeBSD : git -- multiple vulnerabilities (3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8)	Nessus	FreeBSD Local Security Checks	low
214142	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : Git vulnerabilities (USN-7207-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2024-50349

low

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low