CVE-2024-50338: Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials
The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format key=value. Git’s documentation restricts the use of the NUL (\0) character and newlines to form part of the keys[^1] or values.
References
- github.com/advisories/GHSA-86c2-4x57-wc8g
- github.com/git-ecosystem/git-credential-manager
- github.com/git-ecosystem/git-credential-manager/compare/749e287571c78a2b61f926ccce6a707050871ab8...99e2f7f60e7364fe807e7925f361a81f3c47bd1b
- github.com/git-ecosystem/git-credential-manager/releases/tag/v2.6.1
- github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g
- nvd.nist.gov/vuln/detail/CVE-2024-50338
Code Behaviors & Features
Detect and mitigate CVE-2024-50338 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →