Critical Vulnerability in Git Package: Arbitrary Code Execution Risk
Summary
UBUNTU-CVE-2024-32004: Git is a revision control system. Affects git versions < 1:2.17.1-1ubuntu0.18+esm1. Fixed in 1:2.17.1-1ubuntu0.18+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely-used version control system that allows developers to track changes in source code during software development. It is known for its speed, efficiency, and support for distributed, non-linear workflows. However, certain versions of Git have been found to be vulnerable to a serious security issue that can lead to arbitrary code execution when cloning repositories from untrusted sources.
Vulnerability Detail
The vulnerability, identified as CVE-2024-32004, allows an attacker to prepare a malicious local repository that, when cloned, executes arbitrary code on the user's machine. This issue affects versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. The ramifications of this vulnerability are severe, as it can lead to unauthorized access and control over the affected system, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
1:2.17.1-1ubuntu0.18+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid cloning repositories from untrusted sources to mitigate the risk of executing malicious code.
Conclusion
The CVE-2024-32004 vulnerability in Git poses a significant risk of arbitrary code execution when cloning repositories from untrusted sources. Users are strongly advised to update to the latest patched versions of Git to protect their systems. In the meantime, exercising caution when cloning repositories can help mitigate potential risks.
See every vulnerability recorded for git →
FAQ
CVE-2024-32004 is a security vulnerability in Git that allows arbitrary code execution when cloning malicious repositories.
Versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update Git immediately, avoid cloning repositories from untrusted sources as a temporary measure.
The CVSS score for CVE-2024-32004 is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for git.
