PT-2025-2873 · Unknown+1 · Git For Windows+2
Vdyepublished
·
Published
2025-01-14
·
Updated
2025-01-27
·
CVE-2024-50338
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Git Credential Manager versions prior to 2.6.1
Git for Windows versions prior to 2.47.1.2
Description
The issue arises from a mismatch in newline character treatment between Git and Git Credential Manager (GCM). GCM considers LF, CRLF, and CR as valid line endings, whereas Git only considers LF and CRLF as newline characters. This discrepancy allows an attacker to craft a malicious remote URL, potentially capturing credentials for another Git remote when a user clones or interacts with a malicious repository. The attack is heightened when cloning from repositories with submodules using the --recursive clone option, as the user cannot inspect submodule remote URLs beforehand.
Recommendations
Git Credential Manager versions prior to 2.6.1: Upgrade to version 2.6.1 or later to patch the issue.
Git for Windows versions prior to 2.47.1.2: Upgrade to version 2.47.1.2 or later to patch the issue.
Users unable to upgrade: Only interact with trusted remote repositories and avoid cloning with --recursive to allow inspection of submodule URLs before cloning.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Git
Git Credential Manager
Git For Windows