Multiple vulnerabilities in Git for Windows



Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2024-52005
CVE-2024-50349
CVE-2024-52006
CWE-ID CWE-116
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Git for Windows
Other software / Other software solutions

Vendor Git for Windows

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Improper Encoding or Escaping of Output

EUVDB-ID: #VU102871

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-52005

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when handling ANSI escape sequences in messages  passed via sideband channel. A remote attacker can pass specially crafted messages to the terminal and potentially execute untrusted scripts.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Git for Windows: 2.40.0 - 2.48.0

CPE2.3 External links

http://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Encoding or Escaping of Output

EUVDB-ID: #VU102870

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50349

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing  attack.

The vulnerability exists due to incorrect handling of control sequences in account names when asking for credentials. A remote attacker can trick the victim into clicking on a specially crafted URL and trick users into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Git for Windows: 2.40.0 - 2.48.0

CPE2.3 External links

http://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Encoding or Escaping of Output

EUVDB-ID: #VU102869

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-52006

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

Exploit availability: No

Description

The vulnerability allows a remote attacker to exfiltrate data.

The vulnerability exists due to newline confusion in credential helpers when interpreting single Carriage Return characters. A remote attacker can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Git for Windows: 2.40.0 - 2.48.0

CPE2.3 External links

http://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###