Description Preview
Git, a widely used distributed version control system, has a vulnerability where it improperly handles trailing carriage returns (CR) in configuration values. When a config entry is written with a trailing CR, it is not quoted, leading to the loss of the CR when the config is read later. This issue can manifest during the initialization of submodules if the submodule path contains a trailing CR, resulting in an incorrect checkout location. If a symlink exists that points to this altered path and the submodule contains an executable post-checkout hook, the script may execute unintentionally after the checkout process. This vulnerability has been addressed in multiple versions of Git, including v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Overview
- CVE ID: CVE-2025-48384
- Published Date: July 8, 2025
- Severity: High (CVSS Base Score: 8.0)
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Impact: High on confidentiality, integrity, and availability
- Weaknesses: CWE-59 (Improper Link Resolution), CWE-436 (Declaration of Intent)
Remediation
To mitigate the risks associated with CVE-2025-48384, users are advised to upgrade to one of the fixed versions of Git. The following versions contain the necessary patches:
- v2.43.7
- v2.44.4
- v2.45.4
- v2.46.4
- v2.47.3
- v2.48.2
- v2.49.1
- v2.50.1
It is recommended to regularly check for updates and apply them promptly to ensure the security of the system.
References
- Git Security Advisory - Detailed information regarding the vulnerability and its remediation.
Early Warning
Customers using Armis Early Warning were notified about this vulnerability before it appeared in CISA's Known Exploited Vulnerabilities Catalog, enabling them to assess their exposure and act proactively. Armis offers these examples of CVEs already included in CISA KEV for potential customers. Click here to learn how to receive alerts earlier.
- Armis Alert Date
- Jul 8, 2025
- CISA KEV Date
- Aug 25, 2025
48days early
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing: Medium
- Public AdministrationPublic Administration: Medium
- Health Care & Social AssistanceHealth Care & Social Assistance: Medium
- Finance and InsuranceFinance and Insurance: Medium
- Transportation & WarehousingTransportation & Warehousing: Medium
- Educational ServicesEducational Services: Medium
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services: Medium
- Retail TradeRetail Trade: Medium
- Other Services (except Public Administration)Other Services (except Public Administration): Medium
- UtilitiesUtilities: Low
- Arts, Entertainment & RecreationArts, Entertainment & Recreation: Low
- Management of Companies & EnterprisesManagement of Companies & Enterprises: Low
- InformationInformation: Low
- Accommodation & Food ServicesAccommodation & Food Services: Low
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting: Low
- MiningMining: Low
- ConstructionConstruction: Low
- Real Estate Rental & LeasingReal Estate Rental & Leasing: Low
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services: Low
- Wholesale TradeWholesale Trade: Low
