CVE-2022-24975

A flaw known as “GitBleed” was found in Git, where repositories cloned via the “–mirror” option may leak secrets or sensitive information if not properly removed/deleted earlier. This flaw allows attackers and bug bounty hunters to use this discrepancy in Git behavior to find hidden secrets and other sensitive data in public repositories.

Mitigation

Organizations can mitigate this by analyzing a fuller copy of their repositories using the “–mirror” option and removing sensitive data using tools like BFG or git-filter-repo. Garbage collection and pruning in git is also recommended.

Organizations should not analyze regular cloned copies (without the “–mirror” option) since that may provide a false sense of security, and should not rely on methods of removing secrets such as deleting a branch or rewinding history via the “git reset” command.