CVE-2024-50349

4.7 · MEDIUM

Published Jan 14, 2025 debian CWE-116 EPSS 0.67% (49th pctl) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Overview

CVE-2024-50349 is a medium-severity vulnerability affecting debian debian_linux. It was published on January 14, 2025 and has a CVSS 3.1 base score of 4.7 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 4.7, rated MEDIUM. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical Description

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs,

Remediation

Check the references section for vendor advisories and patches from debian. Update debian_linux to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
git	git	>= 0, < 2.40.4	Affected

References

GitHub github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8 GitHub github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577 GitHub github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr Ref lists.debian.org/debian-lts-announce/2025/01/msg00025.html

Frequently Asked Questions

What is CVE-2024-50349?

CVE-2024-50349 is a medium-severity vulnerability affecting debian debian_linux. It was published on January 14, 2025 and has a CVSS 3.1 base score of 4.7 (MEDIUM).

How severe is CVE-2024-50349?

This vulnerability has a CVSS 3.1 base score of 4.7, rated MEDIUM. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-50349?

How can CyberStrike help with CVE-2024-50349?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-50349 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719