From: <rsbecker@nexbridge.com>
To: "'brian m. carlson'" <sandals@crustytoothpaste.net>,
"'Thomas Klausner'" <wiz@gatalith.at>
Cc: <git@vger.kernel.org>
Subject: RE: CVE-2024-52005 status?
Date: Sun, 2 Nov 2025 11:19:37 -0500 [thread overview]
Message-ID: <01a101dc4c14$7f8f8000$7eae8000$@nexbridge.com> (raw)
In-Reply-To: <aQd_iisOrwX909Fr@fruit.crustytoothpaste.net>
On November 2, 2025 10:58 AM, brian m. carlson wrote:
>On 2025-11-02 at 00:48:53, Thomas Klausner wrote:
>> Hi!
>>
>> I'm trying to find out more details about CVE-2024-52005 so I can
>> handle it correctly in pkgsrc.
>>
>> https://nvd.nist.gov/vuln/detail/CVE-2024-52005
>>
>> points to
>>
>> https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329
>>
>> which lists many affected versions, but no fixed versions. I only
>> found one reference to the CVE in the release announcement for 'Git
>> for Windows' 2.47.1(2):
>>
>> https://groups.google.com/g/git-packagers/c/ZWDc6K6tYcc/m/VxikezMeCgAJ
>>
>> The CVE description sounds like this also might affect non-Windows Git
>> versions. Can someone please tell me if this was fixed, and in which
>> version?
>
>We determined this was not a vulnerability. The Git for Windows maintainer
>disagreed and listed it as one nevertheless.
>
>The problem is that on some terminal emulators, including at least some of the ones
>available on Windows, you can execute arbitrary binaries by creating a hyperlink via
>terminal codes and having someone click on it.
>That is, however, a bug in the terminal emulator and not in Git, since clicking a URL
>should not lead to code execution.
If the code that dumps messages like this is localized, perhaps we can run a filter that
removes any non-printable characters (like \ESC) that could trigger this. It might be
switchable in some variable like core.filterUnprintableCharacters=true to opt-in to
prevent this. However, some emulators might just see a URL and treat it like a link,
so I don't know.
prev parent reply other threads:[~2025-11-02 16:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-02 0:48 CVE-2024-52005 status? Thomas Klausner
2025-11-02 15:58 ` brian m. carlson
2025-11-02 16:19 ` rsbecker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='01a101dc4c14$7f8f8000$7eae8000$@nexbridge.com' \
--to=rsbecker@nexbridge.com \
--cc=git@vger.kernel.org \
--cc=sandals@crustytoothpaste.net \
--cc=wiz@gatalith.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).