Git up to 2.48.1 ANSI Escape Sequence escape output

Summaryinfo

A vulnerability labeled as critical has been found in Git up to 2.48.1. Affected by this vulnerability is an unknown functionality of the component ANSI Escape Sequence Handler. The manipulation results in escape output. This vulnerability is known as CVE-2024-52005. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Git up to 2.48.1. Affected is an unknown part of the component ANSI Escape Sequence Handler. The manipulation with an unknown input leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

The advisory is available at github.com. This vulnerability is traded as CVE-2024-52005 since 11/04/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 231817 (Linux Distros Unpatched Vulnerability : CVE-2024-52005), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (231817). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Versioning Software

Name

• Git

Version

• 2.40.0
• 2.40.1
• 2.40.2
• 2.40.3
• 2.40.4
• 2.41.0
• 2.41.1
• 2.41.2
• 2.41.3
• 2.42.0
• 2.42.1
• 2.42.2
• 2.42.3
• 2.42.4
• 2.43.0
• 2.43.1
• 2.43.2
• 2.43.3
• 2.43.4
• 2.43.5
• 2.43.6
• 2.44.0
• 2.44.1
• 2.44.2
• 2.44.3
• 2.45.0
• 2.45.1
• 2.45.2
• 2.45.3
• 2.46.0
• 2.46.1
• 2.46.2
• 2.46.3
• 2.47.0
• 2.47.1
• 2.48.0
• 2.48.1

License

• open-source

Website

• Product: https://github.com/git/git/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion