Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-48385

Fixed in a distro release EPSS 1%CVSS 8.6

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Published 2025-07-08 · CVE record · OSV

Products: git

Distro releases

ReleasePackageFixed in
AlmaLinux 10git-all2.47.3-1.el10_0
AlmaLinux 10git-core-doc2.47.3-1.el10_0
AlmaLinux 10git-email2.47.3-1.el10_0
AlmaLinux 10git-gui2.47.3-1.el10_0
AlmaLinux 10git-instaweb2.47.3-1.el10_0
AlmaLinux 10git-subtree2.47.3-1.el10_0
AlmaLinux 10git-svn2.47.3-1.el10_0
AlmaLinux 10gitk2.47.3-1.el10_0
AlmaLinux 10gitweb2.47.3-1.el10_0
AlmaLinux 10perl-Git2.47.3-1.el10_0
AlmaLinux 10perl-Git-SVN2.47.3-1.el10_0
AlmaLinux 8git2.43.7-1.el8_10
AlmaLinux 8git-all2.43.7-1.el8_10
AlmaLinux 8git-core2.43.7-1.el8_10
AlmaLinux 8git-core-doc2.43.7-1.el8_10
AlmaLinux 8git-credential-libsecret2.43.7-1.el8_10
AlmaLinux 8git-daemon2.43.7-1.el8_10
AlmaLinux 8git-email2.43.7-1.el8_10
AlmaLinux 8git-gui2.43.7-1.el8_10
AlmaLinux 8git-instaweb2.43.7-1.el8_10
AlmaLinux 8git-subtree2.43.7-1.el8_10
AlmaLinux 8git-svn2.43.7-1.el8_10
AlmaLinux 8gitk2.43.7-1.el8_10
AlmaLinux 8gitweb2.43.7-1.el8_10
AlmaLinux 8perl-Git2.43.7-1.el8_10
AlmaLinux 8perl-Git-SVN2.43.7-1.el8_10
AlmaLinux 9git2.47.3-1.el9_6
AlmaLinux 9git-all2.47.3-1.el9_6
AlmaLinux 9git-core2.47.3-1.el9_6
AlmaLinux 9git-core-doc2.47.3-1.el9_6
AlmaLinux 9git-credential-libsecret2.47.3-1.el9_6
AlmaLinux 9git-daemon2.47.3-1.el9_6
AlmaLinux 9git-email2.47.3-1.el9_6
AlmaLinux 9git-gui2.47.3-1.el9_6
AlmaLinux 9git-instaweb2.47.3-1.el9_6
AlmaLinux 9git-subtree2.47.3-1.el9_6
AlmaLinux 9git-svn2.47.3-1.el9_6
AlmaLinux 9gitk2.47.3-1.el9_6
AlmaLinux 9gitweb2.47.3-1.el9_6
AlmaLinux 9perl-Git2.47.3-1.el9_6
AlmaLinux 9perl-Git-SVN2.47.3-1.el9_6
Alpine 3.19git2.43.7-r0
Alpine 3.20git2.45.4-r0
Alpine 3.21git2.47.3-r0
Alpine 3.22git2.49.1-r0
Alpine 3.23git2.50.1-r0
Alpine 3.24git2.50.1-r0
Amazon Linux 2git2.47.3-1.amzn2.0.1
Amazon Linux 2git-all2.47.3-1.amzn2.0.1
Amazon Linux 2git-core2.47.3-1.amzn2.0.1
Amazon Linux 2git-core-doc2.47.3-1.amzn2.0.1
Amazon Linux 2git-credential-libsecret2.47.3-1.amzn2.0.1
Amazon Linux 2git-cvs2.47.3-1.amzn2.0.1
Amazon Linux 2git-daemon2.47.3-1.amzn2.0.1
Amazon Linux 2git-email2.47.3-1.amzn2.0.1
Amazon Linux 2git-gui2.47.3-1.amzn2.0.1
Amazon Linux 2git-instaweb2.47.3-1.amzn2.0.1
Amazon Linux 2git-p42.47.3-1.amzn2.0.1
Amazon Linux 2git-subtree2.47.3-1.amzn2.0.1
Amazon Linux 2git-svn2.47.3-1.amzn2.0.1
Amazon Linux 2gitk2.47.3-1.amzn2.0.1
Amazon Linux 2gitweb2.47.3-1.amzn2.0.1
Amazon Linux 2perl-Git2.47.3-1.amzn2.0.1
Amazon Linux 2perl-Git-SVN2.47.3-1.amzn2.0.1
Amazon Linux 2023git2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-all2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-core2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-core-doc2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-credential-libsecret2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-cvs2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-daemon2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-email2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-gui2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-instaweb2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-p42.50.1-1.amzn2023.0.1
Amazon Linux 2023git-subtree2.50.1-1.amzn2023.0.1
Amazon Linux 2023git-svn2.50.1-1.amzn2023.0.1
Amazon Linux 2023gitk2.50.1-1.amzn2023.0.1
Amazon Linux 2023gitweb2.50.1-1.amzn2023.0.1
Amazon Linux 2023perl-Git2.50.1-1.amzn2023.0.1
Amazon Linux 2023perl-Git-SVN2.50.1-1.amzn2023.0.1
Debian 12git1:2.39.5-0+deb12u3
Debian 13git1:2.47.3-0+deb13u1
Debian 14git1:2.50.1-0.1
Red Hat Enterprise Linux 10.0git0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-all0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-core0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-core-debuginfo0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-core-doc0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-credential-libsecret0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-credential-libsecret-debuginfo0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-daemon0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-daemon-debuginfo0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-debuginfo0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-debugsource0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-email0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-gui0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-instaweb0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-subtree0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0git-svn0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0gitk0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0gitweb0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0perl-Git0:2.47.3-1.el10_0
Red Hat Enterprise Linux 10.0perl-Git-SVN0:2.47.3-1.el10_0
Red Hat Enterprise Linux 8git0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-all0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-core0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-core-debuginfo0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-core-doc0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-credential-libsecret0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-credential-libsecret-debuginfo0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-daemon0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-daemon-debuginfo0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-debuginfo0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-debugsource0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-email0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-gui0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-instaweb0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-subtree0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8git-svn0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8gitk0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8gitweb0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8perl-Git0:2.43.7-1.el8_10
Red Hat Enterprise Linux 8perl-Git-SVN0:2.43.7-1.el8_10
Red Hat Enterprise Linux 9git0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-all0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-core0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-core-debuginfo0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-core-doc0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-credential-libsecret0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-credential-libsecret-debuginfo0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-daemon0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-daemon-debuginfo0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-debuginfo0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-debugsource0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-email0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-gui0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-instaweb0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-subtree0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9git-svn0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9gitk0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9gitweb0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9perl-Git0:2.47.3-1.el9_6
Red Hat Enterprise Linux 9perl-Git-SVN0:2.47.3-1.el9_6
Red Hat rhel e4s 8.8git0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-all0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-core0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-core-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-core-doc0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-credential-libsecret0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-credential-libsecret-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-daemon0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-daemon-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-debugsource0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-email0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-gui0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-instaweb0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-subtree0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8git-svn0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8gitk0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8gitweb0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8perl-Git0:2.39.5-1.el8_8.2
Red Hat rhel e4s 8.8perl-Git-SVN0:2.39.5-1.el8_8.2
Red Hat rhel e4s 9.2git0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-all0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-core0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-core-debuginfo0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-core-doc0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-credential-libsecret0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-credential-libsecret-debuginfo0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-daemon0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-daemon-debuginfo0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-debuginfo0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-debugsource0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-email0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-gui0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-instaweb0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-subtree0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2git-svn0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2gitk0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2gitweb0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2perl-Git0:2.39.5-1.el9_2.2
Red Hat rhel e4s 9.2perl-Git-SVN0:2.39.5-1.el9_2.2
Red Hat rhel eus 9.4git0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-all0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-core0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-core-debuginfo0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-core-doc0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-credential-libsecret0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-credential-libsecret-debuginfo0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-daemon0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-daemon-debuginfo0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-debuginfo0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-debugsource0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-email0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-gui0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-instaweb0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-subtree0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4git-svn0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4gitk0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4gitweb0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4perl-Git0:2.43.5-1.el9_4.2
Red Hat rhel eus 9.4perl-Git-SVN0:2.43.5-1.el9_4.2
Red Hat rhel tus 8.8git0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-all0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-core0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-core-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-core-doc0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-credential-libsecret0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-credential-libsecret-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-daemon0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-daemon-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-debuginfo0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-debugsource0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-email0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-gui0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-instaweb0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-subtree0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8git-svn0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8gitk0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8gitweb0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8perl-Git0:2.39.5-1.el8_8.2
Red Hat rhel tus 8.8perl-Git-SVN0:2.39.5-1.el8_8.2
Rocky Linux 8git0:2.43.7-1.el8_10
Rocky Linux 9git0:2.47.3-1.el9_6
SUSE Enterprise Storage 7.1git2.43.7-150300.10.51.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise Micro 5.5git2.43.7-150300.10.51.1
SUSE Linux Enterprise Module for Basesystem 15 SP6git2.51.0-150600.3.12.1
SUSE Linux Enterprise Module for Basesystem 15 SP7git2.51.0-150600.3.12.1
SUSE Linux Enterprise Module for Development Tools 15 SP6git2.51.0-150600.3.12.1
SUSE Linux Enterprise Module for Development Tools 15 SP6git-lfs3.7.0-150600.13.3.1
SUSE Linux Enterprise Module for Development Tools 15 SP6obs-scm-bridge0.7.4-150600.14.4.1
SUSE Linux Enterprise Module for Development Tools 15 SP7git2.51.0-150600.3.12.1
SUSE Linux Enterprise Module for Development Tools 15 SP7git-lfs3.7.0-150600.13.3.1
SUSE Linux Enterprise Module for Development Tools 15 SP7obs-scm-bridge0.7.4-150600.14.4.1
SUSE Linux Enterprise Module for Python 3 15 SP6python-PyYAML6.0.2-150600.10.3.1
SUSE Linux Enterprise Module for Python 3 15 SP7python-PyYAML6.0.2-150600.10.3.1
SUSE Linux Enterprise Server 15 SP3-LTSSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise Server 15 SP4-LTSSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise Server 15 SP5-LTSSgit2.43.7-150300.10.51.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3git2.43.7-150300.10.51.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4git2.43.7-150300.10.51.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5git2.43.7-150300.10.51.1
SUSE Linux Micro 6.0git2.51.0-1.1
SUSE Linux Micro 6.1git2.51.0-slfo.1.1_1.1
SUSE Manager Proxy LTS 4.3git2.43.7-150300.10.51.1
SUSE Manager Server LTS 4.3git2.43.7-150300.10.51.1
Ubuntu 22.04 LTSgit1:2.34.1-1ubuntu1.13
Ubuntu 24.04 LTSgit1:2.43.0-1ubuntu7.3
Ubuntu Pro 16.04 LTSgit1:2.7.4-0ubuntu1.10+esm9
Ubuntu Pro 18.04 LTSgit1:2.17.1-1ubuntu0.18+esm2
Ubuntu Pro 20.04 LTSgit1:2.25.1-1ubuntu3.14+esm1
openSUSE Leap 15.6git2.51.0-150600.3.12.1
openSUSE Leap 15.6git-lfs3.7.0-150600.13.3.1
openSUSE Leap 15.6obs-scm-bridge0.7.4-150600.14.4.1
openSUSE Leap 15.6python-PyYAML6.0.2-150600.10.3.1
openSUSE Tumbleweedgit2.50.1-1.1