Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade git-guiUpgrade git-daemonUpgrade git-instawebUpgrade perl-GitUpgrade git-emailUpgrade gitkUpgrade git-subtreeUpgrade git-core-docUpgrade git-coreUpgrade gitwebUpgrade gitUpgrade git-allUpgrade git-svnUpgrade git-credential-libsecretUpgrade perl-Git-SVN | Jul 24, 2025 | Jul 8, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 8, 2025 |
| Amazon Linux Ami 2 | — | Upgrade git-credential-libsecretUpgrade gitUpgrade git-coreUpgrade git-svnUpgrade perl-GitUpgrade gitwebUpgrade perl-Git-SVNUpgrade git-allUpgrade gitkUpgrade git-subtreeUpgrade git-daemonUpgrade git-emailUpgrade git-cvsUpgrade git-p4Upgrade git-debuginfoUpgrade git-instawebUpgrade git-core-docUpgrade git-gui | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade git-daemonUpgrade perl-Git-SVNUpgrade git-cvsUpgrade git-subtreeUpgrade git-debugsourceUpgrade git-coreUpgrade git-credential-libsecretUpgrade git-instawebUpgrade git-svnUpgrade git-daemon-debuginfoUpgrade gitUpgrade git-p4Upgrade gitwebUpgrade gitkUpgrade git-guiUpgrade git-credential-libsecret-debuginfoUpgrade git-allUpgrade git-core-debuginfoUpgrade perl-GitUpgrade git-core-docUpgrade git-emailUpgrade git-debuginfo | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade git | Jul 10, 2025 | Jul 8, 2025 |
| Freebsd | — | Upgrade git-guiUpgrade git-svnUpgrade git-cvsUpgrade gitUpgrade git-p4 | Jul 9, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gitUpgrade git-help | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade gitUpgrade git-help | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gitUpgrade git-coreUpgrade git-help | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gitUpgrade git-coreUpgrade git-help | Oct 24, 2025 | Sep 9, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-p4Upgrade git-gnome-keyringUpgrade git-cvsUpgrade git-bzrUpgrade git-coreUpgrade git-subtreeUpgrade perl-Git-SVNUpgrade gitkUpgrade git-svnUpgrade git-credential-libsecretUpgrade git-daemonUpgrade gitUpgrade git-hgUpgrade git-emailUpgrade gitwebUpgrade git-allUpgrade git-core-docUpgrade emacs-gitUpgrade git-guiUpgrade git-instawebUpgrade perl-GitUpgrade emacs-git-el | Jul 23, 2025 | Jul 8, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade perl-GitUpgrade git-hgUpgrade git-daemon-debuginfoUpgrade gitwebUpgrade emacs-git-elUpgrade git-core-docUpgrade git-allUpgrade git-credential-libsecretUpgrade gitUpgrade gitkNo solution existsUpgrade git-debugsourceUpgrade git-debuginfoUpgrade git-emailUpgrade git-coreUpgrade git-bzrUpgrade git-instawebUpgrade git-daemonUpgrade git-svnUpgrade git-cvsUpgrade git-credential-libsecret-debuginfoUpgrade emacs-gitUpgrade git-core-debuginfoUpgrade git-p4Upgrade git-subtreeUpgrade git-gnome-keyringUpgrade git-guiUpgrade perl-Git-SVN | Jul 9, 2025 | Jul 8, 2025 |
| Rocky_linux | — | Upgrade git-subtreeUpgrade git-debuginfoUpgrade git-credential-libsecret-debuginfoUpgrade git-core-debuginfoUpgrade git-daemonUpgrade git-daemon-debuginfoUpgrade git-credential-libsecretUpgrade git-coreUpgrade gitUpgrade git-debugsource | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade gitUpgrade gitkUpgrade git-archUpgrade perl-gitUpgrade git-daemonUpgrade git-p4Upgrade git-emailUpgrade git-cvsUpgrade git-lfsUpgrade git-guiUpgrade git-docUpgrade git-coreUpgrade git-svnUpgrade git-webUpgrade git-credential-libsecret | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade gitkUpgrade gitUpgrade git-gui (Ubuntu Pro)Upgrade gitk (Ubuntu Pro)Upgrade git (Ubuntu Pro)Upgrade git-gui | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub