CVE-2024-52005

What it actually does

Git client fails to sanitize ANSI escape sequences in sideband channel messages from remote servers, allowing direct printing of control sequences to the user's terminal via stderr during clone, fetch, or push operations.

Why it matters to the business

Attackers can mislead users into running untrusted commands or hide critical error information during routine source code operations, increasing risk of supply chain compromise in environments relying on untrusted repositories; high prevalence of Git makes widespread exposure likely.

How an attack unfolds

An attacker hosts a malicious Git server that injects ANSI control sequences into informational or error messages sent over the sideband channel; when a victim clones, fetches, or pushes from this server the sequences reach the terminal and can conceal output, prompt unsafe actions, or execute scripts.

How to fix it

Upgrade python-django, python-django-bash-completion, and python-django-doc packages to version 1.8.7-1.el7 or later on Red Hat OpenStack 7 systems; users unable to upgrade must avoid recursive clones from untrusted sources.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases listed for each affected Red Hat package; test by connecting to a server emitting ANSI sequences and verifying they no longer appear in terminal output.

Typical attack path

1. Set up a Git server that returns crafted sideband messages containing ANSI escapes
2. Trick a victim into cloning, fetching, or pushing from the malicious remote
3. Sequences manipulate the terminal display or induce the user to run attacker-chosen commands
4. Payload executes or further social engineering succeeds without user realizing the source

How to detect it

Review terminal logs and shell history for unexpected ANSI sequences or commands executed during Git operations; inspect network traffic or Git protocol traces for sideband messages containing escape characters from untrusted remotes.

What your security team should do

• Apply the 1.8.7-1.el7 updates immediately on all listed Red Hat OpenStack 7 systems
• Audit internal Git workflows to restrict clones from untrusted remotes until patches are deployed
• Monitor EPSS and KEV status for any increase in exploit activity