PT-2025-28648 · Git+11 · Git+11
Dgl
·
Published
2025-07-08
·
Updated
2026-01-16
·
CVE-2025-48385
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions:
Git versions prior to 2.43.7
Git versions prior to 2.44.4
Git versions prior to 2.45.4
Git versions prior to 2.46.4
Git versions prior to 2.47.3
Git versions prior to 2.48.2
Git versions prior to 2.49.1
Git versions prior to 2.50.1
Description:
The issue arises from the Git client's insufficient validation of advertised bundles when cloning a repository, allowing the remote server to perform protocol injection. This can cause the client to write fetched content to a location controlled by the adversary, potentially leading to arbitrary code execution. The vulnerability can be exploited when the
bundle.heuristic config option is enabled, and in some cases, it requires the adversary to control where a repository will be cloned to, which can be achieved through social engineering or recursive clones with submodules.Recommendations:
For Git versions prior to 2.43.7, update to version 2.43.7 or later.
For Git versions prior to 2.44.4, update to version 2.44.4 or later.
For Git versions prior to 2.45.4, update to version 2.45.4 or later.
For Git versions prior to 2.46.4, update to version 2.46.4 or later.
For Git versions prior to 2.47.3, update to version 2.47.3 or later.
For Git versions prior to 2.48.2, update to version 2.48.2 or later.
For Git versions prior to 2.49.1, update to version 2.49.1 or later.
For Git versions prior to 2.50.1, update to version 2.50.1 or later.
As a temporary workaround, consider disabling the
bundle.heuristic config option to prevent the use of bundle URIs.
Restrict access to recursive clones to minimize the risk of exploitation.Exploit
Fix
Untrusted Search Path
Argument Injection
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Git
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu