rhsa-2025:11462
Vulnerability from csaf_redhat
Published
2025-07-21 14:51
Modified
2025-08-20 07:12
Summary
Red Hat Security Advisory: git security update
Notes
Topic
An update for git is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)
* git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)
* git: Git arbitrary code execution (CVE-2025-48384)
* git: Git arbitrary file writes (CVE-2025-48385)
* gitk: Git file creation flaw (CVE-2025-27613)
* gitk: git script execution flaw (CVE-2025-27614)
* git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for git is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)\n\n* git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)\n\n* git: Git arbitrary code execution (CVE-2025-48384)\n\n* git: Git arbitrary file writes (CVE-2025-48385)\n\n* gitk: Git file creation flaw (CVE-2025-27613)\n\n* gitk: git script execution flaw (CVE-2025-27614)\n\n* git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:11462",
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2337824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337824"
},
{
"category": "external",
"summary": "2337956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337956"
},
{
"category": "external",
"summary": "2378806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2378806"
},
{
"category": "external",
"summary": "2378808",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2378808"
},
{
"category": "external",
"summary": "2379124",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379124"
},
{
"category": "external",
"summary": "2379125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379125"
},
{
"category": "external",
"summary": "2379326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379326"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11462.json"
}
],
"title": "Red Hat Security Advisory: git security update",
"tracking": {
"current_release_date": "2025-08-20T07:12:39+00:00",
"generator": {
"date": "2025-08-20T07:12:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.6"
}
},
"id": "RHSA-2025:11462",
"initial_release_date": "2025-07-21T14:51:13+00:00",
"revision_history": [
{
"date": "2025-07-21T14:51:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-07-21T14:51:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-08-20T07:12:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.47.3-1.el9_6.src",
"product": {
"name": "git-0:2.47.3-1.el9_6.src",
"product_id": "git-0:2.47.3-1.el9_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.47.3-1.el9_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-core-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-core-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-daemon-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-daemon-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-subtree-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-subtree-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-debugsource-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-debugsource-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.47.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_id": "git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.47.3-1.el9_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-core-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-core-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-daemon-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-daemon-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-subtree-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-subtree-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.47.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_id": "git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.47.3-1.el9_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-core-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-core-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-daemon-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-daemon-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-subtree-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-subtree-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-debugsource-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-debugsource-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.47.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_id": "git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.47.3-1.el9_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "git-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-0:2.47.3-1.el9_6.s390x",
"product_id": "git-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-core-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-core-0:2.47.3-1.el9_6.s390x",
"product_id": "git-core-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"product_id": "git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-daemon-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-daemon-0:2.47.3-1.el9_6.s390x",
"product_id": "git-daemon-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-subtree-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-subtree-0:2.47.3-1.el9_6.s390x",
"product_id": "git-subtree-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-subtree@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-debugsource-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-debugsource-0:2.47.3-1.el9_6.s390x",
"product_id": "git-debugsource-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debugsource@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_id": "git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-debuginfo@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_id": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-credential-libsecret-debuginfo@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_id": "git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-daemon-debuginfo@2.47.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-debuginfo-0:2.47.3-1.el9_6.s390x",
"product": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_id": "git-debuginfo-0:2.47.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-debuginfo@2.47.3-1.el9_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "git-all-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "git-all-0:2.47.3-1.el9_6.noarch",
"product_id": "git-all-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-all@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-core-doc-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "git-core-doc-0:2.47.3-1.el9_6.noarch",
"product_id": "git-core-doc-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-core-doc@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-email-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "git-email-0:2.47.3-1.el9_6.noarch",
"product_id": "git-email-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-email@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-gui-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "git-gui-0:2.47.3-1.el9_6.noarch",
"product_id": "git-gui-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-gui@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-instaweb-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "git-instaweb-0:2.47.3-1.el9_6.noarch",
"product_id": "git-instaweb-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-instaweb@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "git-svn-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "git-svn-0:2.47.3-1.el9_6.noarch",
"product_id": "git-svn-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-svn@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "gitk-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "gitk-0:2.47.3-1.el9_6.noarch",
"product_id": "gitk-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gitk@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "gitweb-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "gitweb-0:2.47.3-1.el9_6.noarch",
"product_id": "gitweb-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gitweb@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "perl-Git-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "perl-Git-0:2.47.3-1.el9_6.noarch",
"product_id": "perl-Git-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-Git@2.47.3-1.el9_6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "perl-Git-SVN-0:2.47.3-1.el9_6.noarch",
"product": {
"name": "perl-Git-SVN-0:2.47.3-1.el9_6.noarch",
"product_id": "perl-Git-SVN-0:2.47.3-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-Git-SVN@2.47.3-1.el9_6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.47.3-1.el9_6.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src"
},
"product_reference": "git-0:2.47.3-1.el9_6.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-all-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "git-all-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-core-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-core-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-core-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-core-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-debuginfo-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-core-doc-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "git-core-doc-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-daemon-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-daemon-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-daemon-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-daemon-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-debuginfo-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debuginfo-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-debugsource-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-debugsource-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-debugsource-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-debugsource-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-email-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "git-email-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-gui-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "git-gui-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-instaweb-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "git-instaweb-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.47.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64"
},
"product_reference": "git-subtree-0:2.47.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.47.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le"
},
"product_reference": "git-subtree-0:2.47.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.47.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x"
},
"product_reference": "git-subtree-0:2.47.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-subtree-0:2.47.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64"
},
"product_reference": "git-subtree-0:2.47.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-svn-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "git-svn-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitk-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "gitk-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitweb-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "gitweb-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-Git-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "perl-Git-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-Git-SVN-0:2.47.3-1.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
},
"product_reference": "perl-Git-SVN-0:2.47.3-1.el9_6.noarch",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-50349",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"discovery_date": "2025-01-14T19:00:58.133257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2337824"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Git. This vulnerability occurs when Git requests credentials via a terminal prompt, for example, without the use of a credential helper. During this process, Git displays the host name for which the credentials are needed, but any URL-encoded parts are decoded and displayed directly. This can allow an attacker to manipulate URLs by including ANSI escape sequences, which can be interpreted by the terminal to mislead users by tricking them into entering passwords that are redirected to malicious attacker-controlled sites.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: Git does not sanitize URLs when asking for credentials interactively",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-50349"
},
{
"category": "external",
"summary": "RHBZ#2337824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-50349",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-50349"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-50349",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50349"
},
{
"category": "external",
"summary": "https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8",
"url": "https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8"
},
{
"category": "external",
"summary": "https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577",
"url": "https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr",
"url": "https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr"
}
],
"release_date": "2025-01-14T18:43:42.620000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "git: Git does not sanitize URLs when asking for credentials interactively"
},
{
"cve": "CVE-2024-52006",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"discovery_date": "2025-01-14T19:09:43.720302+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2337956"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Git. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems, most notably .NET and node.js, interpret single Carriage Return characters as newlines, which render the protections against CVE-2020-5260 incomplete for credential helpers, which has the potential to expose stored credentials to malicious URLs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: Newline confusion in credential helpers can lead to credential exfiltration in git",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-52006"
},
{
"category": "external",
"summary": "RHBZ#2337956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337956"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-52006",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52006"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52006",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52006"
},
{
"category": "external",
"summary": "https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g",
"url": "https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g"
},
{
"category": "external",
"summary": "https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060",
"url": "https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q",
"url": "https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp",
"url": "https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp"
}
],
"release_date": "2025-01-14T18:39:52.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "git: Newline confusion in credential helpers can lead to credential exfiltration in git"
},
{
"cve": "CVE-2025-27613",
"cwe": {
"id": "CWE-73",
"name": "External Control of File Name or Path"
},
"discovery_date": "2025-07-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2379124"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability has been identified in the gitk application that could lead to unauthorized file modification or data loss.\n\nThis flaw manifests in two primary scenarios:\n- Untrusted Repository Cloning: When a user is tricked into cloning an untrusted Git repository and then uses gitk to visualize it without any additional parameters, any writable file on the user\u0027s system can be arbitrarily created or truncated. Exploitation via this method also requires the Support per-file encoding option to be explicitly enabled in Gitk\u0027s preferences, which is not the default setting.\n- \u0027Show origin of this line\u0027 Command: The vulnerability can also be triggered if a user employs the Show origin of this line command within gitk\u0027s main window while viewing a malicious repository. This method does not depend on the Support per-file encoding option being enabled.\n\nThe primary risk is unauthorized file system modification, which could lead to data integrity issues, data loss, or potentially open avenues for further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitk: Git file creation flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team rated this vulnerability as having a Moderate security impact. Exploitation depends on a non-default option being enabled and the user being tricked into cloning the untrusted repository or using the \"Show origin of this line\" command in the main window.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-27613"
},
{
"category": "external",
"summary": "RHBZ#2379124",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379124"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-27613",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27613"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-27613",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27613"
},
{
"category": "external",
"summary": "https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v",
"url": "https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v"
},
{
"category": "external",
"summary": "https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/",
"url": "https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2025/07/08/4",
"url": "https://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"release_date": "2025-07-08T13:01:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gitk: Git file creation flaw"
},
{
"cve": "CVE-2025-27614",
"discovery_date": "2025-07-09T22:54:11.462000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2379125"
}
],
"notes": [
{
"category": "description",
"text": "Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitk: git script execution flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has rated this vulnerability as having a Moderate impact as it depends on the user to be tricked to run the command using the malicious file as parameter.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-27614"
},
{
"category": "external",
"summary": "RHBZ#2379125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379125"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-27614",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27614"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-27614",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27614"
},
{
"category": "external",
"summary": "https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/",
"url": "https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2025/07/08/4",
"url": "https://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"release_date": "2025-07-08T13:01:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
},
{
"category": "workaround",
"details": "There\u0027s no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gitk: git script execution flaw"
},
{
"cve": "CVE-2025-46835",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2025-07-10T16:00:54.639582+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2379326"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in the git GUI package. When a user clones an untrusted repository and edits a file located in a maliciously named directory, git GUI may end up creating or overwriting arbitrary files for the running user has written permission. This flaw allows an attacker to modify the content of target files without the affected user\u0027s intent, resulting in a data integrity issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: Git GUI can create and overwrite files for which the user has write permission",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security team has rated this vulnerability as having a Low severity. The is due to the high complexity in exploiting the vulnerability. Additionally, the user needs to be tricked into cloning an untrusted repository and editing a file located in a directory with a maliciously crafted name.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-46835"
},
{
"category": "external",
"summary": "RHBZ#2379326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-46835",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46835"
},
{
"category": "external",
"summary": "https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da",
"url": "https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da"
},
{
"category": "external",
"summary": "https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg",
"url": "https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg"
}
],
"release_date": "2025-07-10T15:09:42.735000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "git: Git GUI can create and overwrite files for which the user has write permission"
},
{
"cve": "CVE-2025-48384",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2025-07-08T19:00:48.297925+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2378806"
}
],
"notes": [
{
"category": "description",
"text": "A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return (CR) are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read, resulting in the submodule being checked out to an incorrect location.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: Git arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability marked as Important and not Moderate flaw because it undermines Git\u2019s path and config integrity by allowing carriage return (\\r) injection to manipulate submodule checkout behavior. Git previously failed to quote config values containing trailing CR, causing the value to be misinterpreted when read back. In the context of submodules, this leads to incorrect path resolution, allowing an attacker to redirect the checkout path via a symlink to a sensitive directory like .git/modules/\u003csubmodule\u003e/hooks. If an executable post-checkout hook exists there, it could be inadvertently executed, resulting in arbitrary code execution during submodule operations. This is particularly dangerous in automated CI/CD pipelines or multi-repo projects where submodules are initialized or updated without manual inspection.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-48384"
},
{
"category": "external",
"summary": "RHBZ#2378806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2378806"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-48384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48384"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48384",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48384"
},
{
"category": "external",
"summary": "https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384",
"url": "https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384"
},
{
"category": "external",
"summary": "https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89",
"url": "https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
"url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
}
],
"release_date": "2025-07-08T18:23:48.710000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "git: Git arbitrary code execution"
},
{
"cve": "CVE-2025-48385",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2025-07-08T19:00:55.106787+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2378808"
}
],
"notes": [
{
"category": "description",
"text": "A bundled uri handling flaw was found in Git. When cloning a repository, Git knows to optionally fetch a bundle advertised by the remote server, which allows the server side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: Git arbitrary file writes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability marked as Important rather than a Moderate flaw because it enables protocol injection at the transport layer of Git\u0027s bundle-uri mechanism, allowing a remote server to manipulate how and where data is written on the client system during a clone operation. The lack of input sanitization on user-controlled values like the URI and target path means that malformed inputs containing spaces or newlines can break protocol framing, leading to arbitrary file writes. In scenarios such as CI pipelines, developer environments, or recursive clones with submodules, an attacker can exploit this to overwrite critical files or inject malicious content, potentially achieving remote code execution (RCE).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-48385"
},
{
"category": "external",
"summary": "RHBZ#2378808",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2378808"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-48385",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48385"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655",
"url": "https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655"
}
],
"release_date": "2025-07-08T18:23:44.405000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-07-21T14:51:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:11462"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:git-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-all-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-core-doc-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-credential-libsecret-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-daemon-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debuginfo-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-debugsource-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-email-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-gui-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-instaweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:git-subtree-0:2.47.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:git-svn-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitk-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:gitweb-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-0:2.47.3-1.el9_6.noarch",
"AppStream-9.6.0.Z.MAIN.EUS:perl-Git-SVN-0:2.47.3-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "git: Git arbitrary file writes"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…