CVE-2024-32004

NameCVE-2024-32004
DescriptionGit is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1071160

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
git (PTS)buster1:2.20.1-2+deb10u3vulnerable
buster (security)1:2.20.1-2+deb10u8vulnerable
bullseye (security), bullseye1:2.30.2-1+deb11u2vulnerable
bookworm1:2.39.2-1.1vulnerable
trixie1:2.43.0-1vulnerable
sid1:2.45.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gitsource(unstable)1:2.45.1-11071160

Notes

https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8

Search for package or bug name: Reporting problems