CVE-2024-52006

一、漏洞信息
 漏洞编号：[CVE-2024-52006](https://nvd.nist.gov/vuln/detail/CVE-2024-52006)
 漏洞归属组件：[git](https://gitee.com/src-openeuler/git)
 漏洞归属的版本：2.27.0,2.30.0,2.33.0,2.36.1,2.39.1,2.41.0,2.43.0,2.46.0,2.47.1,2.48.0,2.48.1
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
 漏洞公开时间：2025-01-15 03:15:32
 漏洞创建时间：2025-01-16 10:21:38
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-52006
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g |  |
| security-advisories.github.com | https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 |  |
| security-advisories.github.com | https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q |  |
| security-advisories.github.com | https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp |  |
| suse_bugzilla | https://smelt.suse.de/incident/36973/ | https://bugzilla.suse.com/show_bug.cgi?id=1235601 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-52006 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0016.html |
| git | https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q | https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp |
| git | https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g | https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-52006 | https://explore.alas.aws.amazon.com/CVE-2024-52006.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52006 | https://explore.alas.aws.amazon.com/CVE-2024-52006.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 |  | security-advisories.github.com |
|  |  | https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 |  | debian |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way.
 openEuler评分：
  4.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(2.48.1):受影响
2.openEuler-20.03-LTS-SP4(2.27.0):受影响
3.openEuler-22.03-LTS-SP3(2.33.0):受影响
4.openEuler-22.03-LTS-SP4(2.33.0):受影响
5.openEuler-24.03-LTS(2.43.0):受影响
6.openEuler-24.03-LTS-Next(2.43.0):受影响
7.openEuler-24.03-LTS-SP1(2.43.0):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.48.1):否
2.openEuler-20.03-LTS-SP4(2.27.0):否
3.openEuler-22.03-LTS-SP3(2.33.0):否
4.openEuler-22.03-LTS-SP4(2.33.0):否
5.openEuler-24.03-LTS(2.43.0):否
6.openEuler-24.03-LTS-Next(2.43.0):否
7.openEuler-24.03-LTS-SP1(2.43.0):否

原因说明：
  1.master(2.48.1):正常修复
2.openEuler-20.03-LTS-SP4(2.27.0):正常修复
3.openEuler-22.03-LTS-SP3(2.33.0):正常修复
4.openEuler-22.03-LTS-SP4(2.33.0):正常修复
5.openEuler-24.03-LTS(2.43.0):正常修复
6.openEuler-24.03-LTS-Next(2.43.0):正常修复
7.openEuler-24.03-LTS-SP1(2.43.0):正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1068

src-openEuler/git

Content Risk Flag

Comments (47)

src-openEuler/git .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-52006

Comments (47)

Search

src-openEuler/git