PT-2022-6487 · Git+2 · Git+2
Mark Esler
·
Published
2022-02-11
·
Updated
2025-09-10
·
CVE-2022-24975
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Git versions through 2.35.1
Description
The issue is related to the disclosure of information in the error data area of the distributed version control system Git. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. The --mirror documentation for Git does not mention the availability of deleted content, also known as the "GitBleed" issue. It has been noted that around 18% of secrets in 50,000 public repositories were missed when using the standard git clone command instead of git clone --mirror.
Recommendations
For Git versions through 2.35.1, consider using the git clone --mirror command instead of the standard git clone command to ensure that all data, including deleted content, is cloned and audited. Additionally, utilize features such as push protection and pre-commit hooks to prevent secrets from being committed to repositories. If secrets have already been committed, contact technical support for assistance.
Exploit
Fix
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Git