Important: git security update
Summary
ALSA-2024:4083: Important: git security update. Affects git versions < 2.43.5-1.el9_4. Fixed in 2.43.5-1.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system with a decentralized architecture. It allows users to work on and contribute to projects without the need for permission to push changes to official repositories. Git also enables offline work. It is widely used for version control in software development.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Git:
-
Recursive clones RCE (CVE-2024-32002): This vulnerability allows remote code execution during recursive clones.
-
RCE while cloning local repos (CVE-2024-32004): This vulnerability enables remote code execution when cloning local repositories.
-
Additional local RCE (CVE-2024-32465): This vulnerability allows remote code execution in certain local scenarios.
-
Insecure hardlinks (CVE-2024-32020): This vulnerability involves insecure hardlinks that can be exploited.
-
Symlink bypass (CVE-2024-32021): This vulnerability allows bypassing of symlinks.
These vulnerabilities can lead to unauthorized code execution, compromising the integrity and security of Git repositories.
How To Fix
Minimum fixed version
2.43.5-1.el9_4
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating Git to version 2.43.5-1.el9_4 or later is crucial to address these vulnerabilities. Failure to update may result in unauthorized code execution and compromise of Git repositories. It is recommended to follow the provided steps to update Git and ensure the security of your system.
See every vulnerability recorded for git →
FAQ
Git is a distributed revision control system used for version control in software development. It allows multiple developers to collaborate on a project and track changes to source code.
These vulnerabilities can lead to remote code execution, potentially allowing attackers to execute arbitrary code on affected systems. This can result in unauthorized access, data breaches, and compromise of Git repositories.
Yes, all versions of Git prior to 2.43.5-1.el9_4 are affected by these vulnerabilities. It is important to update to the latest version to mitigate the risk.
Yes, these vulnerabilities can be exploited remotely, allowing attackers to execute malicious code on vulnerable systems.
No, there are no known workarounds for these vulnerabilities. It is recommended to update Git to the latest version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for git.
