CVE catalog

CVE-2024-50349

Git vulnerabilities

[CVE catalog]

Severity
Low · CVSS 3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangitsid1:2.55.0-1fixed
Debiangitforky1:2.53.0-1fixed
Debiangittrixie1:2.47.3-0+deb13u1fixed
Debiangitbookworm1:2.39.5-0+deb12u3fixed
Debiangitbookworm-security1:2.39.5-0+deb12u2fixed
Ubuntugitnoble1:2.39.5-0+deb12u2fixed
Ubuntugitnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-allnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-cvsnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-daemon-runnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-daemon-sysvinitnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-docnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-emailnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-guinoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-mannoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-mediawikinoble1:2.43.0-1ubuntu7.2fixed
Ubuntugit-svnnoble1:2.43.0-1ubuntu7.2fixed
Ubuntugitknoble1:2.43.0-1ubuntu7.2fixed
Ubuntugitwebnoble1:2.43.0-1ubuntu7.2fixed
Alpinegit3.182.40.4-r0fixed
Alpinegit3.192.43.6-r0fixed
Alpinegit3.202.45.3-r0fixed
Alpinegit3.212.47.2-r0fixed
Alpinegit3.222.48.1-r0fixed
Alpinegit3.232.48.1-r0fixed
Alpinegit3.242.48.1-r0fixed
Susegitlinux micro 6.12.46.0-slfo.1.1_2.1fixed
Susegitlinux micro 6.02.45.1-2.1fixed
Ubuntugit22.041:2.32.0-1ubuntu1vulnerable
Ubuntugit22.041:2.33.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.2vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.4vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.5vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.6vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.8vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.9vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.10vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.11vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.12fixed
Ubuntugit24.041:2.40.1-1ubuntu1vulnerable
Ubuntugit24.041:2.43.0-1ubuntu1vulnerable
Ubuntugit24.041:2.43.0-1ubuntu5vulnerable
Ubuntugit24.041:2.43.0-1ubuntu6vulnerable
Ubuntugit24.041:2.43.0-1ubuntu7vulnerable
Ubuntugit24.041:2.43.0-1ubuntu7.1vulnerable
Ubuntugit24.041:2.43.0-1ubuntu7.2fixed
Ubuntugit20.041:2.20.1-2ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu2vulnerable
Ubuntugit20.041:2.25.0-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.4vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.5vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.6vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.7vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.8vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.10vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.11vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.12vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.13vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.14fixed
Ubuntugitpro1:2.14.1-1ubuntu4vulnerable
Ubuntugitpro1:2.15.1-1ubuntu2vulnerable
Ubuntugitpro1:2.17.0-1ubuntu1vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.1vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.3vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.4vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.5vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.6vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.7vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.8vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.9vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.10vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.11vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.12vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.13vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.14vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.15vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.16vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.17vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.18vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.18+esm1vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.18+esm2vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.18+esm3vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.18+esm4vulnerable
Ubuntugitpro1:2.17.1-1ubuntu0.18+esm6fixed
Ubuntugit20.041:2.20.1-2ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu1vulnerable
Ubuntugit20.041:2.24.0-1ubuntu2vulnerable
Ubuntugit20.041:2.25.0-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.1vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.2vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.3vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.4vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.5vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.6vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.7vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.8vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.10vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.11vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.12vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.13vulnerable
Ubuntugit20.041:2.25.1-1ubuntu3.14fixed
Ubuntugit22.041:2.32.0-1ubuntu1vulnerable
Ubuntugit22.041:2.33.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.1vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.2vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.4vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.5vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.6vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.8vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.9vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.10vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.11vulnerable
Ubuntugit22.041:2.34.1-1ubuntu1.12fixed
Ubuntugit24.041:2.40.1-1ubuntu1vulnerable
Ubuntugit24.041:2.43.0-1ubuntu1vulnerable
Ubuntugit24.041:2.43.0-1ubuntu5vulnerable
Ubuntugit24.041:2.43.0-1ubuntu6vulnerable
Ubuntugit24.041:2.43.0-1ubuntu7vulnerable
Ubuntugit24.041:2.43.0-1ubuntu7.1vulnerable
Ubuntugit24.041:2.43.0-1ubuntu7.2fixed
Opensusegittumbleweed2.48.1-1.1fixed
Susegitlinux enterprise micro 5.52.35.3-150300.10.48.1fixed
Susegitlinux enterprise high performance computing 15 sp3-ltss2.35.3-150300.10.48.1fixed
Susegitlinux enterprise high performance computing 15 sp4-espos2.35.3-150300.10.48.1fixed
Susegitlinux enterprise high performance computing 15 sp4-ltss2.35.3-150300.10.48.1fixed
Susegitlinux enterprise high performance computing 15 sp5-espos2.35.3-150300.10.48.1fixed
Susegitlinux enterprise high performance computing 15 sp5-ltss2.35.3-150300.10.48.1fixed
Susegitlinux enterprise server 15 sp3-ltss2.35.3-150300.10.48.1fixed
Susegitlinux enterprise server 15 sp4-ltss2.35.3-150300.10.48.1fixed
Susegitlinux enterprise server 15 sp5-ltss2.35.3-150300.10.48.1fixed
Susegitlinux enterprise server for sap applications 15 sp32.35.3-150300.10.48.1fixed
Susegitlinux enterprise server for sap applications 15 sp42.35.3-150300.10.48.1fixed
Susegitlinux enterprise server for sap applications 15 sp52.35.3-150300.10.48.1fixed
Susegitmanager proxy 4.32.35.3-150300.10.48.1fixed
Susegitmanager server 4.32.35.3-150300.10.48.1fixed
Susegitenterprise storage 7.12.35.3-150300.10.48.1fixed
Susegitlinux enterprise module for basesystem 15 sp62.43.0-150600.3.9.1fixed
Susegitlinux enterprise module for development tools 15 sp62.43.0-150600.3.9.1fixed
Opensusegitleap 15.62.43.0-150600.3.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangitsourcesid1:2.47.2-0.1not yet assignedNot reported[1093042]
Debiangitsourceforky1:2.47.2-0.1not yet assignedNot reported[1093042]
Debiangitsourcetrixie1:2.47.2-0.1not yet assignedNot reported[1093042]
Debiangitsourcebookworm1:2.39.5-0+deb12u2not yet assignedNot reported[1093042]
Ubuntugitdebnoble1:2.39.5-0+deb12u2Not reportedNot reportedNot reported
Ubuntugitdebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-alldebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-cvsdebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-daemon-rundebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-daemon-sysvinitdebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-docdebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-emaildebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-guidebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-mandebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-mediawikidebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugit-svndebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugitkdebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Ubuntugitwebdebnoble1:2.43.0-1ubuntu7.2Not reportedNot reportedNot reported
Alpinegitapk3.182.40.4-r0Not reportedALPINE-CVE-2024-50349Not reported
Alpinegitapk3.192.43.6-r0Not reportedALPINE-CVE-2024-50349Not reported
Alpinegitapk3.202.45.3-r0Not reportedALPINE-CVE-2024-50349Not reported
Alpinegitapk3.212.47.2-r0Not reportedALPINE-CVE-2024-50349Not reported
Alpinegitapk3.222.48.1-r0Not reportedALPINE-CVE-2024-50349Not reported
Alpinegitapk3.232.48.1-r0Not reportedALPINE-CVE-2024-50349Not reported
Alpinegitapk3.242.48.1-r0Not reportedALPINE-CVE-2024-50349Not reported
Susegitrpmlinux micro 6.12.46.0-slfo.1.1_2.1Not reportedSUSE-RU-2025:20362-1Not reported
Susegitrpmlinux micro 6.02.45.1-2.1Not reportedSUSE-SU-2025:20197-1Not reported
Ubuntugitdeb22.041:2.34.1-1ubuntu1.12Not reportedUSN-7207-1Not reported
Ubuntugitdeb24.041:2.43.0-1ubuntu7.2Not reportedUSN-7207-1Not reported
Ubuntugitdeb20.041:2.25.1-1ubuntu3.14Not reportedUSN-7207-2Not reported
Ubuntugitdebpro1:2.17.1-1ubuntu0.18+esm6Not reportedUBUNTU-CVE-2024-50349Not reported
Ubuntugitdeb20.041:2.25.1-1ubuntu3.14Not reportedUBUNTU-CVE-2024-50349Not reported
Ubuntugitdeb22.041:2.34.1-1ubuntu1.12Not reportedUBUNTU-CVE-2024-50349Not reported
Ubuntugitdeb24.041:2.43.0-1ubuntu7.2Not reportedUBUNTU-CVE-2024-50349Not reported
Opensusegitrpmtumbleweed2.48.1-1.1Not reportedOPENSUSE-SU-2025:14652-1Not reported
Susegitrpmlinux enterprise micro 5.52.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp3-ltss2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp4-espos2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp4-ltss2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp5-espos2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise high performance computing 15 sp5-ltss2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise server 15 sp3-ltss2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise server 15 sp4-ltss2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise server 15 sp5-ltss2.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise server for sap applications 15 sp32.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise server for sap applications 15 sp42.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise server for sap applications 15 sp52.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmmanager proxy 4.32.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmmanager server 4.32.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmenterprise storage 7.12.35.3-150300.10.48.1Not reportedSUSE-SU-2025:0144-1Not reported
Susegitrpmlinux enterprise module for basesystem 15 sp62.43.0-150600.3.9.1Not reportedSUSE-SU-2025:0116-1Not reported
Susegitrpmlinux enterprise module for development tools 15 sp62.43.0-150600.3.9.1Not reportedSUSE-SU-2025:0116-1Not reported
Opensusegitrpmleap 15.62.43.0-150600.3.9.1Not reportedSUSE-SU-2025:0116-1Not reported

[Debian bug #1093042]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References