CVE-2025-48386
MediumAdvisory
Published 8 Jul 2025In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 33rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 163
- of 17,781 indexed, latest versions
- Container images
- 143
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Git allows a buffer overflow in 'wincred' credential helper
Carried by container images the latest versions of 163 of 17,781 indexed charts deploy, on 143 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| gitdeb | 1:2.7.4-0ubuntu1.3, 1:2.7.4-0ubuntu1.4, 1:2.7.4-0ubuntu1.6, 1:2.7.4-0ubuntu1.7+26 more | 1:2.7.4-0ubuntu1.10+esm9, 1:2.17.1-1ubuntu0.18+esm2, 1:2.25.1-1ubuntu3.14+esm1, 1:2.34.1-1ubuntu1.13+1 more | 106 |
| gitapk | 2.40.4-r0, 2.43.0-r0, 2.43.4-r0, 2.43.5-r0+6 more | 2.43.7-r0, 2.45.4-r0, 2.47.3-r0, 2.49.1-r0+1 more | 36 |
| gitbitnami | 2.50.0-1 | 2.50.1 | 1 |
- OSV records
- ALPINE-CVE-2025-48386BIT-git-2025-48386UBUNTU-CVE-2025-48386
- Also known as
- GHSA-4v56-3xvj-xvfr, USN-7626-1
Charts affected
163 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| sdnc-promsmo-helm-chart | 6.0.0 | 1 of 2See more | 24,776 |
| sdnc-websmo-helm-chart | 6.0.0 | 1 of 3See more | 24,776 |
| ueb-listenersmo-helm-chart | 6.0.0 | 1 of 3See more | 25,769 |
| testing-multitoolsomeblackmagic | 0.1.2 | 1 of 1See more | 30,687 |
| convert-datasvtechVerified publisher | 0.13.2 | 1 of 3See more | 7,588 |
| elasticsearchsvtech-public-helm-charts | 1.0.0 | 1 of 1See more | 12,048 |
| preparationsvtech-public-helm-charts | 1.0.0 | 1 of 1See more | 12,048 |
| rundecksvtech-public-helm-charts | 1.0.0 | 1 of 2See more | 18,756 |
| vehicle-dashboardtest-vehi-dash | 0.1.0 | 1 of 7See more | 20,270 |
| node-redthl-chartsVerified publisher | 0.1.0 | 1 of 1See more | 2,806 |
| harbor-scanner-trivytrivy-operator | 0.31.2 | 1 of 1See more | 2,477 |
| kongwallarmVerified publisher | 4.6.3 | 1 of 7See more | 11,405 |
| playwright-synthetic-monitoringwork-adventure | 1.0.1 | 1 of 1See more | 14,100 |
Container images carrying it
143 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| gitlab/ | 860d4a3fec7a | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| hashicorp/ | b77efab1a448 | git | 2.45.4-r0 | 1 |
| haugene/ | 059216cfae4b | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| haveagitgat/ | 1256348872ce | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| helicone/ | 4c69b971a7e4 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| hmediade/ | 7f005eb6c718 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| huginn/ | c794eddc7b47 | git | 1:2.17.1-1ubuntu0.18+esm2 | 1 |
| hyperledger/ | c65891b6c237 | git | 1:2.7.4-0ubuntu1.10+esm9 | 1 |
| ibmcom/ | b5d8c6714dbc | git | 1:2.7.4-0ubuntu1.10+esm9 | 1 |
| indevlab/ | 8bc689d093a7 | git | 2.43.7-r0 | 1 |
| inseefrlab/ | 31f04ca7436b | git | 1:2.34.1-1ubuntu1.13 | 1 |
| jedi132000/ | dc2a81e92f23 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| jmferrer/ | 030f68ec6998 | git | 1:2.7.4-0ubuntu1.10+esm9 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| jupyterhub/ | e4770285aaf7 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| jupyterhub/ | e3e6f3051df8 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| kong/ | a6ac46531193 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| kubeshop/ | e97dc620d9b4 | git | 2.45.4-r0 | 1 |
| kusionstack/ | 126c8f0b0976 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| library/ | 851f91d24121 | git | 2.47.3-r0 | 1 |
| library/ | aa3df78ecf32 | git | 2.47.3-r0 | 1 |
| library/ | dd43b430341a | git | 2.45.4-r0 | 1 |
| librenms/ | 0920bc9117a8 | git | 2.43.7-r0 | 1 |
| linuxserver/ | 45c5fe102ff3 | git | 1:2.17.1-1ubuntu0.18+esm2 | 1 |
| linuxserver/ | a5e43a05ae79 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| lsstsqre/ | b75bf8aaafa4 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| maksymhencha/ | 7f096a681192 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| mavrick1/ | 45ca0429a1d4 | git | 2.47.3-r0 | 1 |
| mediagis/ | c15e941485ef | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| mediagis/ | d0eae7b51374 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| mshanley80/ | 5b189a70c0fb | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| muluder/ | 43b597a93da7 | git | 1:2.7.4-0ubuntu1.10+esm9 | 1 |
| nodered/ | e2632a7a35dd | git | 2.43.7-r0 | 1 |
| odavid/ | e7ab3bbc948e | git | 2.45.4-r0 | 1 |
| omecproject/ | 5715e5648aa0 | git | 1:2.7.4-0ubuntu1.10+esm9 | 1 |
| opendatacube/ | 5d810e8504b8 | git | 1:2.17.1-1ubuntu0.18+esm2 | 1 |
| opendatacube/ | 91870111837c | git | 1:2.17.1-1ubuntu0.18+esm2 | 1 |
| opendatacube/ | 1b90cdf68831 | git | 1:2.17.1-1ubuntu0.18+esm2 | 1 |
| opendatacube/ | 80df355a660b | git | 1:2.34.1-1ubuntu1.13 | 1 |
| openwhisk/ | c80dba0de3aa | git | 1:2.17.1-1ubuntu0.18+esm2 | 1 |
| psorab/ | 53b68896c4ce | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| ryuunosukeds3/ | c0398f13e8a9 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| scholtz2/ | f12ce1cfb72e | git | 1:2.34.1-1ubuntu1.13 | 1 |
| scholtz2/ | 5aaa5d4ab8b8 | git | 1:2.34.1-1ubuntu1.13 | 1 |
| scholtz2/ | 64966de56d9f | git | 1:2.34.1-1ubuntu1.13 | 1 |
| seafileltd/ | 6693911bcc40 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| seafileltd/ | 70628f29c663 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| seafileltd/ | 7ac833196f60 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |
| seafileltd/ | d0c66e4621bd | git | 1:2.34.1-1ubuntu1.13 | 1 |
| seafileltd/ | ed0fcda5e6a9 | git | 1:2.25.1-1ubuntu3.14+esm1 | 1 |