CVE-2024-52006
published 2025-01-14CVE-2024-52006: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.04%
60.4th percentile
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | git | < git 1:2.39.5-0+deb12u2 (bookworm) | git 1:2.39.5-0+deb12u2 (bookworm) |
| git | git | < 2.40.4 | 2.40.4 |
| git | git | — | — |
| git | git | >= 0 < 1:2.30.2-1+deb11u4 | 1:2.30.2-1+deb11u4 |
| git | git | >= 0 < 1:2.39.5-0+deb12u2 | 1:2.39.5-0+deb12u2 |
| git | git | >= 0 < 1:2.47.2-0.1 | 1:2.47.2-0.1 |
| git | git | >= 0 < 1:2.47.2-0.1 | 1:2.47.2-0.1 |
| git | git | >= 0 < 1:2.25.1-1ubuntu3.14 | 1:2.25.1-1ubuntu3.14 |
| git | git | >= 0 < 1:2.34.1-1ubuntu1.12 | 1:2.34.1-1ubuntu1.12 |
| git | git | >= 0 < 1:2.43.0-1ubuntu7.2 | 1:2.43.0-1ubuntu7.2 |
| git | git | >= 0 < 1:2.7.4-0ubuntu1.10+esm13 | 1:2.7.4-0ubuntu1.10+esm13 |
| git | git | >= 0 < 1:2.17.1-1ubuntu0.18+esm6 | 1:2.17.1-1ubuntu0.18+esm6 |
| git | git | >= 2.41.0 < 2.41.3 | 2.41.3 |
| git | git | >= 2.42.0 < 2.42.4 | 2.42.4 |
| git | git | >= 2.43.0 < 2.43.6 | 2.43.6 |
| git | git | >= 2.44.3 < 2.44.3 | 2.44.3 |
| git | git | >= 2.45.3 < 2.45.3 | 2.45.3 |
| git | git | >= 2.46.3 < 2.46.3 | 2.46.3 |
| git | git | >= 2.47.0 < 2.47.2 | 2.47.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.5HIGH
vendor_debian9.3CRITICAL
vendor_redhat9.3CRITICAL
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
git vulnerabilities
osv·2026-01-15·CVSS 2.1
CVE-2024-50349 [LOW] git vulnerabilities
git vulnerabilities
It was discovered that Git did not properly sanitize URLs when asking for
credentials via a terminal prompt. An attacker could possibly use this
issue to trick a user into disclosing their password. (CVE-2024-50349)
It was discovered that Git did not properly handle carriage return
characters in its credential protocol. An attacker could use this issue to
send unexpected data to credential helpers, possibly leading to a user
being tricked into disclosing sensitive information. (CVE-2024-52006)
OSV
git vulnerabilities
osv·2025-02-27·CVSS 2.1
CVE-2024-50349 [LOW] git vulnerabilities
git vulnerabilities
USN-7207-1 fixed vulnerabilities in Git. This update provides the
corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
OSV
git vulnerabilities
osv·2025-01-14·CVSS 2.1
CVE-2024-50349 [LOW] git vulnerabilities
git vulnerabilities
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
OSV
CVE-2024-52006: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full acce
osv·2025-01-14·CVSS 7.5
CVE-2024-52006 [HIGH] CVE-2024-52006: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full acce
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive
Ubuntu
Git vulnerabilities
vendor_ubuntu·2026-01-15·CVSS 4.7
CVE-2024-52006 [MEDIUM] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
It was discovered that Git did not properly sanitize URLs when asking for
credentials via a terminal prompt. An attacker could possibly use this
issue to trick a user into disclosing their password. (CVE-2024-50349)
It was discovered that Git did not properly handle carriage return
characters in its credential protocol. An attacker could use this issue to
send unexpected data to credential helpers, possibly leading to a user
being tricked into disclosing sensitive information. (CVE-2024-52006)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Git vulnerabilities
vendor_ubuntu·2025-02-27·CVSS 4.7
CVE-2024-52006 [MEDIUM] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
USN-7207-1 fixed vulnerabilities in Git. This update provides the
corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
git: Newline confusion in credential helpers can lead to credential exfiltration in git
vendor_redhat·2025-01-14·CVSS 9.3
CVE-2024-52006 [CRITICAL] CWE-116 git: Newline confusion in credential helpers can lead to credential exfiltration in git
git: Newline confusion in credential helpers can lead to credential exfiltration in git
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrad
Ubuntu
Git vulnerabilities
vendor_ubuntu·2025-01-14·CVSS 4.7
CVE-2024-52006 [MEDIUM] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-52006: git - Git is a fast, scalable, distributed revision control system with an unusually r...
vendor_debian·2024·CVSS 9.3
CVE-2024-52006 [CRITICAL] CVE-2024-52006: git - Git is a fast, scalable, distributed revision control system with an unusually r...
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-66413 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.3
CVE-2025-66413 [HIGH] CVE-2025-66413 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-66413 :
Git for Windows vulnerability analysis and mitigation
Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).
Source : NVD
## 7.4
Score
Published March 10, 2026
Severity HIGH
CNA Score 7.4
Affected Technologies
Git for Windows
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:git_for_windows_project:git_for_windows
Sources
NV
Bugzilla
CVE-2024-52006 git: Newline confusion in credential helpers can lead to credential exfiltration in git
bugzilla·2025-01-14·CVSS 7.5
CVE-2024-52006 [HIGH] CVE-2024-52006 git: Newline confusion in credential helpers can lead to credential exfiltration in git
CVE-2024-52006 git: Newline confusion in credential helpers can lead to credential exfiltration in git
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are ad
https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8ghttps://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4qhttps://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrphttps://lists.debian.org/debian-lts-announce/2025/01/msg00025.html
2025-01-14
Published