// For flags

CVE-2024-52005

The sideband payload is passed unfiltered to the terminal in git

Severity Score

7.5
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
Active
System
Vulnerable | Subsequent
Confidentiality
High
None
Integrity
High
None
Availability
High
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-11-04 CVE Reserved
  • 2025-01-15 CVE Published
  • 2025-01-15 CVE Updated
  • 2025-01-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-116: Improper Encoding or Escaping of Output
  • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.48.0 <= 2.48.1
Search vendor "Git" for product "Git" and version " >= 2.48.0 <= 2.48.1"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.47.0 <= 2.47.1
Search vendor "Git" for product "Git" and version " >= 2.47.0 <= 2.47.1"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.46.0 <= 2.46.3
Search vendor "Git" for product "Git" and version " >= 2.46.0 <= 2.46.3"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.45.0 <= 2.45.3
Search vendor "Git" for product "Git" and version " >= 2.45.0 <= 2.45.3"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.44.0 <= 2.44.3
Search vendor "Git" for product "Git" and version " >= 2.44.0 <= 2.44.3"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.43.0 <= 2.43.6
Search vendor "Git" for product "Git" and version " >= 2.43.0 <= 2.43.6"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.42.0 <= 2.42.4
Search vendor "Git" for product "Git" and version " >= 2.42.0 <= 2.42.4"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 >= 2.41.0 <= 2.41.3
Search vendor "Git" for product "Git" and version " >= 2.41.0 <= 2.41.3"
en
Affected
Git
Search vendor "Git"
 Git
Search vendor "Git" for product "Git"
 <= 2.40.4
Search vendor "Git" for product "Git" and version " <= 2.40.4"
en
Affected