> CVE-2025-48385

« BACK_TO_HOME
PUBLISHED
2025-07-08 19:15
MODIFIED
2025-07-10 13:18
EPSS (Prob. Exploit)
1.06%
Top 35.2%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08 MSRC 🔗 2026-06-01

> DESCRIPTION

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 2.47.3
Red Hat - Red Hat Enterprise Linux 8
Version: 2.43.7
Red Hat - Red Hat Enterprise Linux 9
Version: 2.47.3
Red Hat - Red Hat Enterprise Linux 9.4 Extended Update Support
Version: 2.43.5
Red Hat - Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Version: 2.39.5
Red Hat - Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Version: 2.39.5
Red Hat - Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Version: 2.39.5
Red Hat - Red Hat OpenShift Container Platform 4.16
Red Hat - Red Hat OpenShift Container Platform 4.18
Version: 418.94.202508060022
Red Hat - Red Hat Web Terminal 1.11 on RHEL 9
Red Hat - Red Hat Web Terminal 1.12 on RHEL 9
Red Hat - Red Hat OpenShift Container Platform 4.19
Red Hat - Red Hat OpenShift Container Platform 4.13
Red Hat - Red Hat OpenShift Container Platform 4.14
Red Hat - Red Hat OpenShift Container Platform 4.15
Red Hat - Red Hat OpenShift Container Platform 4.17
Red Hat - RHEL-8 based Middleware Containers

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: OpenShift Container Platform 4.13.60 bug fix and security update
Red Hat OpenShift Container Platform release 4.13.60 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: updated web-terminal/tooling container image
Updated web-terminal/tooling container image is now available for Red Hat Web Terminal 1.11 on RHEL 9.
Red Hat Security Advisory: updated web-terminal/tooling container image
Updated web-terminal/tooling container image is now available for Red Hat Web Terminal 1.12 on RHEL 9.
Red Hat Security Advisory: OpenShift Container Platform 4.16.47 bug fix and security update
Red Hat OpenShift Container Platform release 4.16.47 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...
Red Hat Security Advisory: OpenShift Container Platform 4.14.56 bug fix and security update
Red Hat OpenShift Container Platform release 4.14.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...
Red Hat Security Advisory: OpenShift Container Platform 4.15.57 bug fix and security update
Red Hat OpenShift Container Platform release 4.15.57 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...
Red Hat Security Advisory: OpenShift Container Platform 4.17.38 bug fix and security update
Red Hat OpenShift Container Platform release 4.17.38 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...
Red Hat Security Advisory: OpenShift Container Platform 4.19.9 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.9 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: updated RHEL-8 based Middleware Containers container images
Updated RHEL-8 based Middleware Containers container images are now available
Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has...
Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Commo...
Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerab...
Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS...
Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVS...
Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Git alllows arbitrary file writes via bundle-uri parameter injection

AFFECTED PACKAGES:
Unknown / Unknown
465 versions affected
ALIASES:
BIT-git-2025-48385, GHSA-m98c-vgpc-9655

> HISTORIQUE DES MODIFICATIONS

Première apparition
08/07/2025 19:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:05
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:11
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:11
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME