{"thread":{"id":"64420","subject":"CVE-2024-52005 status?","startedAt":"2025-11-02T00:56:47Z","lastAt":"2025-11-02T16:19:58Z","messageCount":3,"participants":["Thomas Klausner","brian m. carlson","rsbecker@nexbridge.com"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"530072","messageId":"7mfgh4ufx6wr3ict2ee6utg3vvfpiy6xi3rfyfu4yionmcwu6a@yry3kefdxbwf","threadId":"64420","inReplyTo":null,"subject":"CVE-2024-52005 status?","fromName":"Thomas Klausner","fromEmail":"wiz@gatalith.at","sentAt":"2025-11-02T00:48:53Z","receivedAt":"2025-11-02T00:56:47Z","isPatch":false,"sender":{"key":"wiz@gatalith.at","avatar":null},"body":"Hi!\n\nI'm trying to find out more details about CVE-2024-52005 so I can\nhandle it correctly in pkgsrc.\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-52005\n\npoints to\n\nhttps://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329\n\nwhich lists many affected versions, but no fixed versions.  I only\nfound one reference to the CVE in the release announcement for 'Git\nfor Windows' 2.47.1(2):\n\nhttps://groups.google.com/g/git-packagers/c/ZWDc6K6tYcc/m/VxikezMeCgAJ\n\nThe CVE description sounds like this also might affect non-Windows Git\nversions. Can someone please tell me if this was fixed, and in which\nversion?\n\nThanks,\n Thomas\n\n(Please cc me, I'm not subscribed.)\n"},{"id":"530074","messageId":"aQd_iisOrwX909Fr@fruit.crustytoothpaste.net","threadId":"64420","inReplyTo":"7mfgh4ufx6wr3ict2ee6utg3vvfpiy6xi3rfyfu4yionmcwu6a@yry3kefdxbwf","subject":"Re: CVE-2024-52005 status?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-11-02T15:58:02Z","receivedAt":"2025-11-02T15:58:11Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-11-02 at 00:48:53, Thomas Klausner wrote:\n> Hi!\n> \n> I'm trying to find out more details about CVE-2024-52005 so I can\n> handle it correctly in pkgsrc.\n> \n> https://nvd.nist.gov/vuln/detail/CVE-2024-52005\n> \n> points to\n> \n> https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329\n> \n> which lists many affected versions, but no fixed versions.  I only\n> found one reference to the CVE in the release announcement for 'Git\n> for Windows' 2.47.1(2):\n> \n> https://groups.google.com/g/git-packagers/c/ZWDc6K6tYcc/m/VxikezMeCgAJ\n> \n> The CVE description sounds like this also might affect non-Windows Git\n> versions. Can someone please tell me if this was fixed, and in which\n> version?\n\nWe determined this was not a vulnerability.  The Git for Windows\nmaintainer disagreed and listed it as one nevertheless.\n\nThe problem is that on some terminal emulators, including at least some\nof the ones available on Windows, you can execute arbitrary binaries by\ncreating a hyperlink via terminal codes and having someone click on it.\nThat is, however, a bug in the terminal emulator and not in Git, since\nclicking a URL should not lead to code execution.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"},{"id":"530081","messageId":"01a101dc4c14$7f8f8000$7eae8000$@nexbridge.com","threadId":"64420","inReplyTo":"aQd_iisOrwX909Fr@fruit.crustytoothpaste.net","subject":"RE: CVE-2024-52005 status?","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2025-11-02T16:19:37Z","receivedAt":"2025-11-02T16:19:58Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On November 2, 2025 10:58 AM, brian m. carlson wrote:\n>On 2025-11-02 at 00:48:53, Thomas Klausner wrote:\n>> Hi!\n>>\n>> I'm trying to find out more details about CVE-2024-52005 so I can\n>> handle it correctly in pkgsrc.\n>>\n>> https://nvd.nist.gov/vuln/detail/CVE-2024-52005\n>>\n>> points to\n>>\n>> https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329\n>>\n>> which lists many affected versions, but no fixed versions.  I only\n>> found one reference to the CVE in the release announcement for 'Git\n>> for Windows' 2.47.1(2):\n>>\n>> https://groups.google.com/g/git-packagers/c/ZWDc6K6tYcc/m/VxikezMeCgAJ\n>>\n>> The CVE description sounds like this also might affect non-Windows Git\n>> versions. Can someone please tell me if this was fixed, and in which\n>> version?\n>\n>We determined this was not a vulnerability.  The Git for Windows maintainer\n>disagreed and listed it as one nevertheless.\n>\n>The problem is that on some terminal emulators, including at least some of the ones\n>available on Windows, you can execute arbitrary binaries by creating a hyperlink via\n>terminal codes and having someone click on it.\n>That is, however, a bug in the terminal emulator and not in Git, since clicking a URL\n>should not lead to code execution.\n\nIf the code that dumps messages like this is localized, perhaps we can run a filter that\nremoves any non-printable characters (like \\ESC) that could trigger this. It might be\nswitchable in some variable like core.filterUnprintableCharacters=true to opt-in to\nprevent this. However, some emulators might just see a URL and treat it like a link,\nso I don't know.\n\n"}]}