Name | CVE-2024-32004 |
Description | Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
References | DLA-3844-1, DLA-3867-1, DSA-5769-1 |
Debian Bugs | 1071160 |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
git (PTS) | bullseye | 1:2.30.2-1+deb11u2 | vulnerable |
bullseye (security) | 1:2.30.2-1+deb11u3 | fixed | |
bookworm | 1:2.39.2-1.1 | vulnerable | |
bookworm (security) | 1:2.39.5-0+deb12u1 | fixed | |
sid, trixie | 1:2.45.2-1 | fixed |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
git | source | buster | 1:2.20.1-2+deb10u9 | DLA-3844-1 | ||
git | source | bullseye | 1:2.30.2-1+deb11u3 | DLA-3867-1 | ||
git | source | bookworm | 1:2.39.5-0+deb12u1 | DSA-5769-1 | ||
git | source | (unstable) | 1:2.45.1-1 | 1071160 |
https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8
https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7
Regression: https://lore.kernel.org/git/924426.1716570031@dash.ant.isi.edu/T/#u