git - security update

Fixed packages 1

Vulnerabilities 8

• Critical 9.1
  CVE-2024-32002 Public exploit EPSS 29%

  Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

  Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule'…

  git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  May 14, 2024
• High 8.2
  CVE-2024-32004 Public exploit

  Git vulnerable to Remote Code Execution while cloning special-crafted local repositories

  Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been …

  git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  May 14, 2024
• High 7.5
  CVE-2023-25652 EPSS 52%

  "git apply --reject" partially-controlled arbitrary file write

  Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…

  git git git git Debian Ubuntu Alpine Wolfi
  Apr 25, 2023
• High 7.4
  CVE-2024-32465

  Git's protections for cloning untrusted repositories can be bypassed

  Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an …

  git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  May 14, 2024
• High 7.0
  CVE-2023-29007 Public exploit

  Arbitrary configuration injection via `git submodule deinit`

  Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…

  git git git git Debian Ubuntu Alpine Wolfi
  Apr 25, 2023
• Low 3.9
  CVE-2024-32021

  Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory

  Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the …

  git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  May 14, 2024
• Low 3.3
  CVE-2023-25815

  Git looks for localized messages in the wrong place

  In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…

  git-for-windows git git git Debian Ubuntu Alpine
  Apr 25, 2023
• Unscored —
  CVE-2019-1387

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…

  Microsoft Git git git Debian Ubuntu Alpine
  Dec 18, 2019