5 ms·

Reproduced the issue after a bit: https://github.com/acheong08/CVE-2025-48384 https://github.com/acheong08/CVE-2025-48384 Then immediately went to update my git

by _k2vp 1y ago

Reproduced the issue after a bit: https://github.com/acheong08/CVE-2025-48384 https://github.com/acheong08/CVE-2025-48384 Then immediately went to update my git version. Still not up on Arch yet. Will refrain from pulling anything but I bet it'll take quite a while for most people to upgrade. Putting it in any reasonable popular repo where there are perhaps automated pulls will be interesting.

orblivion 1y ago
So this was disclosed before patching? With all of the alarming "here's how we can pwn your machine" posts turning out to be months after the fact, I figured by now that these blog posts all happen after all the distros have long patched it. It seems like it would be appropriate to make it clear "this is important now" vs "don't worry you probably already patched this" in the headline to save our time for those who aren't just reading these posts out of interest.
- _lvbh 1y ago
  Commits fixing the bug date back around 3 or 4 weeks. The patched release came 3 weeks ago. Perhaps some parties weren't informed that it's security critical (Homebrew, Arch, etc) and are now scrambling
  - SchemaLoad 1y ago
    Just went and checked and the latest version on macOS is over a year old.. >git version 2.39.5 (Apple Git-154)
  - orblivion 1y ago
    Am I reading this wrong? As of this writing it all says "vulnerable". https://security-tracker.debian.org/tracker/CVE-2025-48384 https://security-tracker.debian.org/tracker/CVE-2025-48384
  - dgl 1y ago
    I'm not privy to the exact communications that happened, but per the Ubuntu changelog they prepared a patch a week ago[1] (which is about the normal timeline for notification per[2]). Homebrew is not on the distros list, so likely wouldn't have got an early notification. Arch is, but remember "The Arch Security Team is a group of volunteers"[3]. [1]: https://launchpad.net/ubuntu/+source/git/1:2.43.0-1ubuntu7.3 https://launchpad.net/ubuntu/+source/git/1:2.43.0-1ubuntu7.3 [2]: https://oss-security.openwall.org/wiki/mailing-lists/distros https://oss-security.openwall.org/wiki/mailing-lists/distros [3]: https://wiki.archlinux.org/title/Arch_Security_Team https://wiki.archlinux.org/title/Arch_Security_Team
beala 1y ago
2.50.1 is up on pacman this morning.

by _k2vp 1y ago

orblivion 1y ago

So this was disclosed before patching? With all of the alarming "here's how we can pwn your machine" posts turning out to be months after the fact, I figured by now that these blog posts all happen after all the distros have long patched it. It seems like it would be appropriate to make it clear "this is important now" vs "don't worry you probably already patched this" in the headline to save our time for those who aren't just reading these posts out of interest.

_lvbh 1y ago
Commits fixing the bug date back around 3 or 4 weeks. The patched release came 3 weeks ago. Perhaps some parties weren't informed that it's security critical (Homebrew, Arch, etc) and are now scrambling
- SchemaLoad 1y ago
  Just went and checked and the latest version on macOS is over a year old.. >git version 2.39.5 (Apple Git-154)
- orblivion 1y ago
  Am I reading this wrong? As of this writing it all says "vulnerable". https://security-tracker.debian.org/tracker/CVE-2025-48384 https://security-tracker.debian.org/tracker/CVE-2025-48384
- dgl 1y ago
  I'm not privy to the exact communications that happened, but per the Ubuntu changelog they prepared a patch a week ago[1] (which is about the normal timeline for notification per[2]). Homebrew is not on the distros list, so likely wouldn't have got an early notification. Arch is, but remember "The Arch Security Team is a group of volunteers"[3]. [1]: https://launchpad.net/ubuntu/+source/git/1:2.43.0-1ubuntu7.3 https://launchpad.net/ubuntu/+source/git/1:2.43.0-1ubuntu7.3 [2]: https://oss-security.openwall.org/wiki/mailing-lists/distros https://oss-security.openwall.org/wiki/mailing-lists/distros [3]: https://wiki.archlinux.org/title/Arch_Security_Team https://wiki.archlinux.org/title/Arch_Security_Team

beala 1y ago

2.50.1 is up on pacman this morning.