Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade git-credential-libsecretUpgrade git-svnUpgrade perl-Git-SVNUpgrade gitwebUpgrade gitUpgrade git-allUpgrade git-coreUpgrade git-core-docUpgrade perl-GitUpgrade gitkUpgrade git-instawebUpgrade git-guiUpgrade git-emailUpgrade git-subtreeUpgrade git-daemon | Jul 24, 2025 | Jul 8, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 8, 2025 |
| Amazon Linux Ami 2 | — | Upgrade git-cvsUpgrade git-debuginfoUpgrade git-daemonUpgrade git-p4Upgrade gitkUpgrade git-emailUpgrade git-instawebUpgrade git-subtreeUpgrade git-core-docUpgrade git-allUpgrade git-guiUpgrade perl-Git-SVNUpgrade git-coreUpgrade git-credential-libsecretUpgrade git-svnUpgrade gitwebUpgrade gitUpgrade perl-Git | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perl-GitUpgrade git-guiUpgrade gitwebUpgrade gitkUpgrade git-emailUpgrade git-core-docUpgrade git-debuginfoUpgrade git-p4Upgrade git-core-debuginfoUpgrade git-allUpgrade git-credential-libsecret-debuginfoUpgrade git-cvsUpgrade perl-Git-SVNUpgrade git-subtreeUpgrade git-coreUpgrade git-debugsourceUpgrade gitUpgrade git-daemon-debuginfoUpgrade git-credential-libsecretUpgrade git-instawebUpgrade git-svnUpgrade git-daemon | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade git | Jul 10, 2025 | Jul 8, 2025 |
| Freebsd | — | Upgrade git-cvsUpgrade git-guiUpgrade git-svnUpgrade gitUpgrade git-p4 | Jul 9, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade git-helpUpgrade git | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade git-helpUpgrade git | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gitUpgrade git-coreUpgrade git-help | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gitUpgrade git-coreUpgrade git-help | Oct 24, 2025 | Sep 9, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-daemonUpgrade git-gnome-keyringUpgrade perl-Git-SVNUpgrade gitkUpgrade git-cvsUpgrade git-subtreeUpgrade git-bzrUpgrade git-hgUpgrade git-credential-libsecretUpgrade git-p4Upgrade git-svnUpgrade git-emailUpgrade gitUpgrade git-coreUpgrade gitwebUpgrade git-allUpgrade git-core-docUpgrade perl-GitUpgrade git-guiUpgrade git-instawebUpgrade emacs-git-elUpgrade emacs-git | Jul 23, 2025 | Jul 8, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade gitkUpgrade gitwebUpgrade perl-GitUpgrade git-daemon-debuginfoUpgrade git-allUpgrade git-core-docUpgrade emacs-git-elUpgrade gitUpgrade git-hgNo solution existsUpgrade git-debugsourceUpgrade git-credential-libsecretUpgrade perl-Git-SVNUpgrade git-instawebUpgrade git-core-debuginfoUpgrade git-subtreeUpgrade git-gnome-keyringUpgrade git-debuginfoUpgrade git-svnUpgrade git-cvsUpgrade git-guiUpgrade git-daemonUpgrade git-coreUpgrade emacs-gitUpgrade git-bzrUpgrade git-p4Upgrade git-emailUpgrade git-credential-libsecret-debuginfo | Jul 9, 2025 | Jul 8, 2025 |
| Rocky_linux | — | Upgrade gitUpgrade git-debugsourceUpgrade git-coreUpgrade git-daemon-debuginfoUpgrade git-credential-libsecretUpgrade git-daemonUpgrade git-credential-libsecret-debuginfoUpgrade git-subtreeUpgrade git-debuginfoUpgrade git-core-debuginfo | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade git-docUpgrade git-svnUpgrade git-coreUpgrade git-webUpgrade git-credential-libsecretUpgrade gitUpgrade git-p4Upgrade gitkUpgrade git-lfsUpgrade git-guiUpgrade git-emailUpgrade git-archUpgrade git-cvsUpgrade perl-GitUpgrade git-daemon | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade gitk (Ubuntu Pro)Upgrade git (Ubuntu Pro)Upgrade git-guiUpgrade gitUpgrade gitkUpgrade git-gui (Ubuntu Pro) | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub