VDB
BDU%3A2025-01178
BDU%3A2025-01178
PUBLISHED
CVSS 7.400000095367432 HIGH
Уязвимость функции strbuf_getdelim_strip_crlf кроссплатформенного фреймворка для хранения учётных данных Git Credential Manager (GCM) распределенной системы управления версиями Git, позволяющая нарушителю раскрыть защищаемую информацию
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft Corp, Linus Torvalds, Junio Hamano | Microsoft Visual Studio 2022, Microsoft Visual Studio 2017, Microsoft Visual Studio 2019, Git | |
| git-ecosystem | git-credential-manager | < 2.6.1 |
Timeline
- Jan 14, 2025 PoC Published
- Jan 14, 2025 PoC Published
- Jan 14, 2025 CVE Published
- Jan 14, 2025 PoC Published
- Jan 27, 2025 PoC Published
- Jan 28, 2025 PoC Published
- Jan 28, 2025 PoC Published
- Feb 6, 2025 CVE Updated
- Sep 1, 2025 PoC Published
- Mar 20, 2026 Security Advisory
References
- https://learn.microsoft.com/en-us/dotnet/api/system.io.streamreader?view=net-8.0 url
- https://git-scm.com/docs/git-credential#IOFMT url
- https://github.com/dotnet/runtime/blob/e476b43b5cb42eb44ce23b1c7b793aa361624cf6/src/libraries/System.Private.CoreLib/src/System/IO/StreamReader.cs#L926 url
- https://github.com/git-ecosystem/git-credential-manager/blob/ae009e11a0fbef804ad9f78816d84a0bc7e052fe/src/shared/Core/StreamExtensions.cs#L138-L141 url
- https://github.com/git-ecosystem/git-credential-manager/compare/749e287571c78a2b61f926ccce6a707050871ab8...99e2f7f60e7364fe807e7925f361a81f3c47bd1b url
- https://github.com/git-ecosystem/git-credential-manager/releases/tag/v2.6.1 url
- https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g url
- https://github.com/git/git/blob/6a11438f43469f3815f2f0fc997bd45792ff04c0/credential.c#L311 url
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-50338 advisory