Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade git-daemonUpgrade gitkUpgrade git-emailUpgrade git-subtreeUpgrade perl-GitUpgrade git-core-docUpgrade git-instawebUpgrade git-guiUpgrade perl-Git-SVNUpgrade gitUpgrade git-credential-libsecretUpgrade git-allUpgrade git-svnUpgrade gitwebUpgrade git-core | Jul 24, 2025 | Jul 8, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 8, 2025 |
| Amazon Linux Ami 2 | — | Upgrade gitUpgrade git-svnUpgrade git-coreUpgrade perl-Git-SVNUpgrade git-credential-libsecretUpgrade gitwebUpgrade perl-GitUpgrade gitkUpgrade git-core-docUpgrade git-daemonUpgrade git-instawebUpgrade git-subtreeUpgrade git-cvsUpgrade git-debuginfoUpgrade git-allUpgrade git-emailUpgrade git-p4Upgrade git-gui | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade git-debuginfoUpgrade gitkUpgrade git-p4Upgrade git-emailUpgrade gitwebUpgrade perl-GitUpgrade git-credential-libsecret-debuginfoUpgrade git-guiUpgrade git-core-debuginfoUpgrade git-core-docUpgrade git-allUpgrade gitUpgrade perl-Git-SVNUpgrade git-subtreeUpgrade git-credential-libsecretUpgrade git-daemon-debuginfoUpgrade git-debugsourceUpgrade git-coreUpgrade git-instawebUpgrade git-daemonUpgrade git-cvsUpgrade git-svn | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade git | Jul 10, 2025 | Jul 8, 2025 |
| Freebsd | — | Upgrade git-cvsUpgrade git-guiUpgrade git-svnUpgrade gitUpgrade git-p4 | Jul 9, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade git-helpUpgrade git | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade gitUpgrade git-help | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade git-helpUpgrade git-coreUpgrade git | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gitUpgrade git-helpUpgrade git-core | Oct 24, 2025 | Sep 9, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-instawebUpgrade gitwebUpgrade git-core-docUpgrade git-guiUpgrade git-allUpgrade emacs-git-elUpgrade emacs-gitUpgrade perl-GitUpgrade gitUpgrade perl-Git-SVNUpgrade git-coreUpgrade git-p4Upgrade git-hgUpgrade gitkUpgrade git-daemonUpgrade git-subtreeUpgrade git-gnome-keyringUpgrade git-cvsUpgrade git-emailUpgrade git-credential-libsecretUpgrade git-bzrUpgrade git-svn | Jul 23, 2025 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade git-subtreeUpgrade git-instawebUpgrade git-emailUpgrade git-cvsUpgrade emacs-gitUpgrade git-credential-libsecret-debuginfoUpgrade git-p4Upgrade git-gnome-keyringUpgrade git-guiUpgrade git-coreUpgrade git-debuginfoUpgrade git-svnUpgrade git-daemonUpgrade git-core-debuginfoUpgrade git-bzrUpgrade perl-Git-SVNUpgrade gitkUpgrade gitUpgrade git-hgUpgrade git-debugsourceNo solution existsUpgrade perl-GitUpgrade git-core-docUpgrade git-credential-libsecretUpgrade emacs-git-elUpgrade gitwebUpgrade git-allUpgrade git-daemon-debuginfo | Jul 9, 2025 | Jul 8, 2025 |
| Rocky_linux | — | Upgrade git-credential-libsecret-debuginfoUpgrade git-debuginfoUpgrade git-subtreeUpgrade git-daemonUpgrade git-core-debuginfoUpgrade git-credential-libsecretUpgrade gitUpgrade git-debugsourceUpgrade git-coreUpgrade git-daemon-debuginfo | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade git-credential-libsecretUpgrade git-coreUpgrade git-webUpgrade git-docUpgrade git-svnUpgrade git-p4Upgrade git-guiUpgrade perl-gitUpgrade git-daemonUpgrade gitkUpgrade git-lfsUpgrade git-emailUpgrade git-archUpgrade git-cvsUpgrade git | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade gitkUpgrade gitUpgrade git-gui (Ubuntu Pro)Upgrade git (Ubuntu Pro)Upgrade git-guiUpgrade gitk (Ubuntu Pro) | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub