Important: git security update
Summary
RLSA-2024:4084: Important: git security update. Affects git versions < 0:2.43.5-1.el8_10. Fixed in 0:2.43.5-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system with a decentralized architecture. It allows users to work on and contribute to projects without the need for permission to push changes to official repositories. Git also enables offline work by ensuring each working copy is an exact copy with complete revision history.
Vulnerability Detail
The following vulnerabilities have been identified in Git:
-
Recursive clones RCE (CVE-2024-32002): This vulnerability allows remote code execution during recursive clones.
-
RCE while cloning local repos (CVE-2024-32004): This vulnerability enables remote code execution when cloning local repositories.
-
Additional local RCE (CVE-2024-32465): This vulnerability allows for additional remote code execution.
-
Insecure hardlinks (CVE-2024-32020): This vulnerability involves insecure hardlinks.
-
Symlink bypass (CVE-2024-32021): This vulnerability allows for symlink bypass.
How To Fix
Minimum fixed version
0:2.43.5-1.el8_10
This is the first release that contains the fix.
sudo dnf update gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update Git to the recommended version to mitigate the identified vulnerabilities. These vulnerabilities can lead to remote code execution and security bypass. For more information and assistance, refer to the provided CVE pages and consider using the Vulert Playground for vulnerability checks.
See every vulnerability recorded for git →
FAQ
Git is a distributed revision control system that allows for decentralized collaboration on projects.
These vulnerabilities can lead to remote code execution and security bypass.
You can use the Vulert Playground at Vulert Scanner to check if your version of Git is affected by these vulnerabilities.
No, there are no known workarounds for these vulnerabilities.
You can refer to the CVE pages listed in the References section of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
