git -- multiple vulnerabilities

2025-01-14 · CVE-2024-50349, CVE-2024-52006 · VuXML entry

Git development team reports: CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the user susceptible to crafted URLs (e.g. in recursive clones) that mislead the user into typing in passwords for trusted sites that would then be sent to untrusted sites instead. CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to credential helpers which use line-reading functions …

Affected versions

• git, git-cvs, git-gui, git-p4, git-svn < 2.48.1

By system

0 still vulnerable, 10 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.