←back to thread

Breaking Git with a carriage return and cloning RCE

(dgl.cx)
358 points dgl | 1 comments | 08 Jul 25 17:48 UTC | HN request time: 0.22s | source
Show context
capitol_ ◴[09 Jul 25 06:08 UTC] No.44506768[source]▶
I'm confused about the timeline here, the tag for 2.50.1 is from 2025-06-16 ( https://github.com/git/git/tags ). And the date for 2.50.1 on https://git-scm.com is also 2025-06-16.

But it seems like almost no distributions have patched it yet

https://security-tracker.debian.org/tracker/CVE-2025-48386 (debian as an example)

And the security advisory is from yesterday: https://github.com/git/git/security/advisories/GHSA-4v56-3xv...

Did git backdate the release?

replies(1): >>44510956 #
1. CodesInChaos ◴[09 Jul 25 15:08 UTC] No.44510956[source]▶
That's the time the commit was authored, not the time the tag was published.