The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. When Git asks for credentials via a     terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user     is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been     decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape     sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git     hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits `7725b81` and `c903985` which are included in release versions     v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to     upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
    (CVE-2024-50349)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0116-1 advisory.

    - CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites (bsc#1235600).
    - CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers (bsc#1235601).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. Git defines a line-based protocol that     is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably,     .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections     against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This     issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2,     v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users     unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.(CVE-2024-52006)

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. When Git asks for credentials via a     terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user     is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been     decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape     sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git     hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits `7725b81` and `c903985` which are included in release versions     v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to     upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive     clones.(CVE-2024-50349)

Tenable has extracted the preceding description block directly from the EulerOS git security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.47.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2737 advisory.

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. When Git asks for credentials via a     terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user     is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been     decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape     sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git     hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits `7725b81` and `c903985` which are included in release versions     v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to     upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
    (CVE-2024-50349)

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that     provides both high-level operations and full access to internals. Git defines a line-based protocol that     is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably,     .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections     against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This     issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1,     v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users     unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. (CVE-2024-52006)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7207-2 advisory.

    USN-7207-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 20.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4031 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4031-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     January 28, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : git     Version        : 1:2.30.2-1+deb11u4     CVE ID         : CVE-2024-50349 CVE-2024-52006     Debian Bug     : 1093042

    Multiple vulnerabilities were discovered in git, a fast, scalable and     distributed revision control system.

    CVE-2024-50349

        When Git asks for credentials via a terminal prompt (i.e. without         using any credential helper), it prints out the host name for which         the user is expected to provide a username and/or a password.  At         this stage, any URL-encoded parts have been decoded already, and are         printed verbatim.  This could allow attackers to craft URLs that         contain ANSI escape sequences that the terminal interpret to confuse         users e.g. into providing passwords for trusted Git hosting sites         when in fact they are then sent to untrusted sites that are under         the attacker's control.

    CVE-2024-52006

        Git defines a line-based protocol that is used to exchange         information between Git and Git credential helpers.  Some ecosystems         (most notably, .NET and node.js) interpret single Carriage Return         characters as newlines, which renders the protections against         CVE-2020-5260 incomplete for credential helpers that treat Carriage         Returns in this way.

    For Debian 11 bullseye, these problems have been fixed in version     1:2.30.2-1+deb11u4.

    We recommend that you upgrade your git packages.

    For the detailed security status of git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11462 advisory.

    [2.47.3-1]
    - update to 2.47.3
    - Resolves: RHEL-102449, RHEL-102463, RHEL-102675, RHEL-102681

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
247291	Linux Distros Unpatched Vulnerability : CVE-2024-50349	Nessus	Misc.	2025/8/10	2026/1/30	low
214254	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : git (SUSE-SU-2025:0116-1)	Nessus	SuSE Local Security Checks	2025/1/16	2025/12/19	low
233599	EulerOS 2.0 SP13 : git (EulerOS-SA-2025-1332)	Nessus	Huawei Local Security Checks	2025/4/1	2025/4/1	low
214610	Amazon Linux 2 : git (ALAS-2025-2737)	Nessus	Amazon Linux Local Security Checks	2025/1/24	2025/12/19	low
216912	Ubuntu 20.04 LTS : Git vulnerabilities (USN-7207-2)	Nessus	Ubuntu Local Security Checks	2025/2/27	2025/12/19	low
233607	EulerOS 2.0 SP13 : git (EulerOS-SA-2025-1315)	Nessus	Huawei Local Security Checks	2025/4/1	2025/4/1	low
214705	Debian dla-4031 : git - security update	Nessus	Debian Local Security Checks	2025/1/28	2025/12/19	low
242548	Oracle Linux 9 : git (ELSA-2025-11462)	Nessus	Oracle Linux Local Security Checks	2025/7/22	2025/8/25	high

检测

插件搜索

low

low

low

low

low

low

low

high