Git arbitrary code execution
CVE: CVE-2025-48384
Component: git
CWE: CWE-93
Severity: Important
CVSS v3: 7.8/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-07-08T18:23:48.710000+00:00

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return (CR) are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read, resulting in the submodule being checked out to an incorrect location.

Statement: This vulnerability marked as Important and not Moderate flaw because it undermines Git’s path and config integrity by allowing carriage return (\r) injection to manipulate submodule checkout behavior. Git previously failed to quote config values containing trailing CR, causing the value to be misinterpreted when read back. In the context of submodules, this leads to incorrect path resolution, allowing an attacker to redirect the checkout path via a symlink to a sensitive directory like .git/modules/<submodule>/hooks. If an executable post-checkout hook exists there, it could be inadvertently executed, resulting in arbitrary code execution during submodule operations. This is particularly dangerous in automated CI/CD pipelines or multi-repo projects where submodules are initialized or updated without manual inspection.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous erratamupdate:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:7c5f757b5d3d2048052401dd057f3096890b4075ca9b86b5f890a8e4c6d38b85

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:32f55a5ff24713e240a293ced4f8cb202bbdf482095593e226d1ea4397fefe8e

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:5f0204b0de50a408dc8b52f568e90aef6b3266ee8d22a77c1b34ceefb2b00f14

      (For s390x architecture)
      The image digest is sha256:758be0c12f06fadff01eb06d514ed48c306679706b3a82b72a2943f211003a7b

      (For ppc64le architecture)
      The image digest is sha256:9d022cdb3929572745d9b77d9f27e29fcc8ff5c7c5d04b404e81600601e7d6c7

      (For aarch64 architecture)
      The image digest is sha256:c75cf7a5560e7352860dcf9ae8f115a7ce7b45ca05744d65af7513ce4913ea7d

All OpenShift Container Platform 4.14 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:dfeabcb6b9d567eaa9c6a32f0e20cc547e0fa2e972963e5cef6e9c15838328f9

      (For s390x architecture)
      The image digest is sha256:0a007b78ea7e6e6a4625c34e7783687a04935462d9b41eafe8663613b31eb753

      (For ppc64le architecture)
      The image digest is sha256:b77a48cdf0b9d89eba520588ffcd99268e3edeb56627e17395b223ca3faf8da1

      (For aarch64 architecture)
      The image digest is sha256:5eb9c8cac53b255dfe62cea367ff461ecf8aff32aa858df39d898e7ad60d06ab

All OpenShift Container Platform 4.15 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:b2d8af25d1a0440fce3e16a7d5481a228c29bdf7510f9c2bbef241e495004992

      (For s390x architecture)
      The image digest is sha256:b8fa63beeecb258529d2b8b22fdd90ef4846691c8e41aaff2d02279d72563a25

      (For ppc64le architecture)
      The image digest is sha256:6847316b4a13f663f32227107ae23f31a223dcc3b7d1718da837b8a539e97212

      (For aarch64 architecture)
      The image digest is sha256:6a66ef4370c883267c500672f7c9b53293a431049fd0ec2496c9ab5ecdcc0ce5

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:fea49ae633643615f8707ecbe801b484181b87db0746d2d85592768dbddf43c9

      (For s390x architecture)
      The image digest is sha256:d3e9032b799e87cc82121c9da006d375845134120205fa2aa2edca033abf97d3

      (For ppc64le architecture)
      The image digest is sha256:6c6251666a8e89289819cdb9dd7269d1ab2d90fdcb96c2b15b2e04908d15fd88

      (For aarch64 architecture)
      The image digest is sha256:3b83546dc680f6e3975faf101471c4e29fdc76f406327665e22f63ff406246c0

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:16078b671c7f5490a2136f2cd9a694d48bb38af1280ef9e2ae9ce28af075cca5

      (For s390x architecture)
      The image digest is sha256:0acecac6ce56112ac0feadc5472a77103f98df529ebb41f7b1e2adb97b6180b5

      (For ppc64le architecture)
      The image digest is sha256:c07839bb178536cb5459bac0178d279f68e905fe8efd0196ecf173d6023f8016

      (For aarch64 architecture)
      The image digest is sha256:8801bfcbdd29d4abd85912a239210ae8d6a79d90e3487fc47bcaaaefc93abf27

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:b6f3a6e7cab0bb6e2590f6e6612a3edec75e3b28d32a4e55325bdeeb7d836662

      (For s390x architecture)
      The image digest is sha256:334e26b0b7452b060884217e3c5e43e81c8c491cf3bafbe1da49e10dd08fdc6e

      (For ppc64le architecture)
      The image digest is sha256:b211f12212c30703f1e50c2275fc65e7e0b8e1d2f9470e41531b289bd99ef1f4

      (For aarch64 architecture)
      The image digest is sha256:87a33ae5b04b02f73de246d388a3468d844010a75ac40c21bd3d72dc1745a046

All OpenShift Container Platform 4.19 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
The Red Hat Web Terminal 1.11 on RHEL 9 container images provided by this update
can be downloaded from the Red Hat Container Registry at
registry.access.redhat.com. Installation instructions for your platform are
available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image
specifically, or to the latest image generally.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To mitigate this issue, avoid using --recurse-submodules when cloning repositories from untrusted sources; instead, clone normally and only initialize or update submodules manually after reviewing them.