Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gitkUpgrade git-daemonUpgrade git-instawebUpgrade git-core-docUpgrade git-guiUpgrade perl-GitUpgrade git-subtreeUpgrade git-emailUpgrade git-svnUpgrade git-coreUpgrade perl-Git-SVNUpgrade gitwebUpgrade git-allUpgrade git-credential-libsecretUpgrade git | Jul 24, 2025 | Jul 8, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 8, 2025 |
| Amazon Linux Ami 2 | — | Upgrade perl-GitUpgrade git-credential-libsecretUpgrade gitwebUpgrade git-coreUpgrade gitUpgrade perl-Git-SVNUpgrade git-svnUpgrade git-debuginfoUpgrade git-cvsUpgrade git-p4Upgrade git-guiUpgrade git-daemonUpgrade git-core-docUpgrade git-allUpgrade git-emailUpgrade gitkUpgrade git-subtreeUpgrade git-instaweb | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade git-svnUpgrade git-daemonUpgrade git-subtreeUpgrade git-cvsUpgrade gitUpgrade git-coreUpgrade git-daemon-debuginfoUpgrade git-debugsourceUpgrade git-instawebUpgrade git-credential-libsecretUpgrade perl-Git-SVNUpgrade gitwebUpgrade git-credential-libsecret-debuginfoUpgrade git-allUpgrade git-guiUpgrade git-emailUpgrade perl-GitUpgrade git-p4Upgrade git-debuginfoUpgrade git-core-docUpgrade gitkUpgrade git-core-debuginfo | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade git | Jul 10, 2025 | Jul 8, 2025 |
| Freebsd | — | Upgrade git-cvsUpgrade git-svnUpgrade git-guiUpgrade git-p4Upgrade git | Jul 9, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gitUpgrade git-help | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade gitUpgrade git-help | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gitUpgrade git-helpUpgrade git-core | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gitUpgrade git-coreUpgrade git-help | Oct 24, 2025 | Sep 9, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-allUpgrade git-instawebUpgrade perl-GitUpgrade emacs-git-elUpgrade git-core-docUpgrade emacs-gitUpgrade gitwebUpgrade git-guiUpgrade git-gnome-keyringUpgrade gitkUpgrade perl-Git-SVNUpgrade git-daemonUpgrade git-hgUpgrade git-emailUpgrade git-svnUpgrade git-cvsUpgrade git-coreUpgrade git-bzrUpgrade git-subtreeUpgrade gitUpgrade git-p4Upgrade git-credential-libsecret | Jul 23, 2025 | Jul 8, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade emacs-gitUpgrade git-debuginfoUpgrade git-instawebUpgrade git-gnome-keyringUpgrade git-svnUpgrade git-subtreeUpgrade git-bzrUpgrade git-p4Upgrade git-coreUpgrade perl-Git-SVNUpgrade git-guiUpgrade git-core-debuginfoUpgrade git-cvsUpgrade git-emailUpgrade git-daemonUpgrade git-credential-libsecret-debuginfoUpgrade git-allUpgrade git-debugsourceUpgrade git-daemon-debuginfoUpgrade gitkUpgrade perl-GitUpgrade gitUpgrade git-core-docUpgrade gitwebUpgrade emacs-git-elUpgrade git-credential-libsecretNo solution existsUpgrade git-hg | Jul 9, 2025 | Jul 8, 2025 |
| Rocky_linux | — | Upgrade git-core-debuginfoUpgrade git-daemonUpgrade git-credential-libsecret-debuginfoUpgrade git-debuginfoUpgrade git-subtreeUpgrade gitUpgrade git-daemon-debuginfoUpgrade git-debugsourceUpgrade git-coreUpgrade git-credential-libsecret | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade git-webUpgrade git-credential-libsecretUpgrade git-docUpgrade git-coreUpgrade git-svnUpgrade git-cvsUpgrade git-emailUpgrade git-p4Upgrade git-lfsUpgrade gitkUpgrade git-guiUpgrade git-daemonUpgrade perl-GitUpgrade git-archUpgrade git | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade gitk (Ubuntu Pro)Upgrade git (Ubuntu Pro)Upgrade git-guiUpgrade gitkUpgrade git-gui (Ubuntu Pro)Upgrade git | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub