Comment by capitol_

6 days ago

I'm confused about the timeline here, the tag for 2.50.1 is from 2025-06-16 ( https://github.com/git/git/tags ). And the date for 2.50.1 on https://git-scm.com is also 2025-06-16.

But it seems like almost no distributions have patched it yet

https://security-tracker.debian.org/tracker/CVE-2025-48386 (debian as an example)

And the security advisory is from yesterday: https://github.com/git/git/security/advisories/GHSA-4v56-3xv...

Did git backdate the release?

1 comment

capitol_

Reply