Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gitkUpgrade git-core-docUpgrade git-guiUpgrade git-subtreeUpgrade git-instawebUpgrade git-emailUpgrade perl-GitUpgrade git-daemonUpgrade git-svnUpgrade git-coreUpgrade git-allUpgrade git-credential-libsecretUpgrade gitUpgrade gitwebUpgrade perl-Git-SVN | Jul 24, 2025 | Jul 8, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 8, 2025 |
| Amazon Linux Ami 2 | — | Upgrade git-svnUpgrade git-credential-libsecretUpgrade perl-Git-SVNUpgrade perl-GitUpgrade gitwebUpgrade gitUpgrade git-coreUpgrade git-allUpgrade git-p4Upgrade git-core-docUpgrade git-guiUpgrade gitkUpgrade git-subtreeUpgrade git-daemonUpgrade git-instawebUpgrade git-cvsUpgrade git-debuginfoUpgrade git-email | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade git-daemonUpgrade git-credential-libsecretUpgrade git-svnUpgrade git-instawebUpgrade gitUpgrade git-cvsUpgrade git-subtreeUpgrade perl-Git-SVNUpgrade git-coreUpgrade git-debugsourceUpgrade git-daemon-debuginfoUpgrade git-guiUpgrade git-p4Upgrade git-debuginfoUpgrade gitkUpgrade git-credential-libsecret-debuginfoUpgrade git-allUpgrade git-emailUpgrade git-core-debuginfoUpgrade git-core-docUpgrade perl-GitUpgrade gitweb | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade git | Jul 10, 2025 | Jul 8, 2025 |
| Freebsd | — | Upgrade gitUpgrade git-p4Upgrade git-svnUpgrade git-guiUpgrade git-cvs | Jul 9, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gitUpgrade git-help | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade git-helpUpgrade git | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade git-coreUpgrade git-helpUpgrade git | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gitUpgrade git-coreUpgrade git-help | Oct 24, 2025 | Sep 9, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2022 to the latest version in the current channel channel.Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-credential-libsecretUpgrade git-gnome-keyringUpgrade git-svnUpgrade git-p4Upgrade git-coreUpgrade gitUpgrade git-subtreeUpgrade git-emailUpgrade git-hgUpgrade git-bzrUpgrade git-cvsUpgrade git-daemonUpgrade gitkUpgrade perl-Git-SVNUpgrade emacs-gitUpgrade git-guiUpgrade git-core-docUpgrade git-instawebUpgrade gitwebUpgrade git-allUpgrade emacs-git-elUpgrade perl-Git | Jul 23, 2025 | Jul 8, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade git-daemonUpgrade git-core-debuginfoUpgrade emacs-gitUpgrade git-credential-libsecret-debuginfoUpgrade git-coreUpgrade git-gnome-keyringUpgrade git-debuginfoUpgrade git-cvsUpgrade git-bzrUpgrade git-emailUpgrade git-guiUpgrade git-p4Upgrade perl-Git-SVNUpgrade git-subtreeUpgrade git-svnUpgrade git-instawebUpgrade gitNo solution existsUpgrade git-allUpgrade gitkUpgrade git-daemon-debuginfoUpgrade gitwebUpgrade git-credential-libsecretUpgrade git-core-docUpgrade git-debugsourceUpgrade emacs-git-elUpgrade git-hgUpgrade perl-Git | Jul 9, 2025 | Jul 8, 2025 |
| Rocky_linux | — | Upgrade git-core-debuginfoUpgrade git-credential-libsecret-debuginfoUpgrade git-debuginfoUpgrade git-subtreeUpgrade git-daemonUpgrade git-coreUpgrade gitUpgrade git-credential-libsecretUpgrade git-daemon-debuginfoUpgrade git-debugsource | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade git-webUpgrade git-coreUpgrade git-credential-libsecretUpgrade git-svnUpgrade git-docUpgrade gitkUpgrade git-guiUpgrade git-archUpgrade git-lfsUpgrade git-p4Upgrade git-cvsUpgrade gitUpgrade git-emailUpgrade perl-gitUpgrade git-daemon | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade git-gui (Ubuntu Pro)Upgrade gitUpgrade gitkUpgrade git (Ubuntu Pro)Upgrade gitk (Ubuntu Pro)Upgrade git-gui | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub