Git Proxy Vulnerability in Application by Finos
CVE-2025-54584

5.7MEDIUM

Key Information:

Vendor

Finos

Status
GitProxy
Vendor
CVE Published:
30 July 2025

What is CVE-2025-54584?

In versions of GitProxy prior to 1.19.2, a vulnerability exists that allows an attacker to exploit the PACK signature detection mechanism in the parsePush.ts file. By creating a specially crafted Git packfile with a misleading PACK signature and manipulating the packet structure, an attacker could deceive the parser into accepting invalid or unintended data as a legitimate packfile. This could result in unauthorized access or the ability to conceal commits, leading to potential security breaches. The issue has been addressed in version 1.19.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/finos/git-proxy/commit/333c98a165a5a1e...
https://github.com/finos/git-proxy/commit/a620a2f33c39c78...
https://github.com/finos/git-proxy/releases/tag/v1.19.2

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.