Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Git for Red Hat Update: Unauthorized Code Execution

published 1 year ago

Summary

The Git software used by Red Hat has a security issue that could allow attackers to execute malicious code on a system. This could happen if a user downloads and runs a specially crafted Git repository. Red Hat has released an update to fix this issue, and users should apply it as soon as possible to ensure their system remains secure.

What to do

Update redhat git to version 0:2.43.5-1.el9_4.2.
Update redhat git-all to version 0:2.43.5-1.el9_4.2.
Update redhat git-core to version 0:2.43.5-1.el9_4.2.
Update redhat git-core-debuginfo to version 0:2.43.5-1.el9_4.2.
Update redhat git-core-doc to version 0:2.43.5-1.el9_4.2.
Update redhat git-credential-libsecret to version 0:2.43.5-1.el9_4.2.
Update redhat git-credential-libsecret-debuginfo to version 0:2.43.5-1.el9_4.2.
Update redhat git-daemon to version 0:2.43.5-1.el9_4.2.
Update redhat git-daemon-debuginfo to version 0:2.43.5-1.el9_4.2.
Update redhat git-debuginfo to version 0:2.43.5-1.el9_4.2.
Update redhat git-debugsource to version 0:2.43.5-1.el9_4.2.
Update redhat git-email to version 0:2.43.5-1.el9_4.2.
Update redhat git-gui to version 0:2.43.5-1.el9_4.2.
Update redhat git-instaweb to version 0:2.43.5-1.el9_4.2.
Update redhat git-subtree to version 0:2.43.5-1.el9_4.2.
Update redhat git-svn to version 0:2.43.5-1.el9_4.2.
Update redhat gitk to version 0:2.43.5-1.el9_4.2.
Update redhat gitweb to version 0:2.43.5-1.el9_4.2.
Update redhat perl-git to version 0:2.43.5-1.el9_4.2.
Update redhat perl-git-svn to version 0:2.43.5-1.el9_4.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.4::appstream	redhat	git	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-all	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-core	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-core-debuginfo	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-core-doc	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-credential-libsecret	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-credential-libsecret-debuginfo	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-daemon	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-daemon-debuginfo	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-debuginfo	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-debugsource	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-email	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-gui	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-instaweb	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-subtree	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	git-svn	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	gitk	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	gitweb	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	perl-git	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2
Red Hat:rhel_eus:9.4::appstream	redhat	perl-git-svn	< 0:2.43.5-1.el9_4.2 Fix: upgrade to 0:2.43.5-1.el9_4.2

Original advisory text

Red Hat Security Advisory: git security update

References

https://access.redhat.com/errata/RHSA-2025:11686 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2378806 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2378808 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11686.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-48384 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-48384 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-48384 Vendor Advisory
https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384 Third Party Advisory
https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89 Third Party Advisory
https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-48385 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-48385 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-48385 Vendor Advisory
https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.3 High

Timeline

Published25 Jul 2025

Updated10 Jun 2026

First seen10 Jun 2026

Sources

RHSA-2025:11686 · OSV

Track software like this

Free during beta