Skip to content
OpenAdvisories
Critical RHSA-2024:4579 2 CVEs

Red Hat Security Advisory: git security update

Published Sep 18, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-all 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-core 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-core-debuginfo 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-core-doc 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-credential-libsecret 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-credential-libsecret-debuginfo 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-daemon 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-daemon-debuginfo 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-debuginfo 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-debugsource 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-email 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-gui 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-instaweb 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-subtree 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream git-svn 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream gitk 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream gitweb 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream perl-Git 0:2.39.5-1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream perl-Git-SVN 0:2.39.5-1.el8_8

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-32002 Public exploit EPSS 29%

    Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule'…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2024-32004 Public exploit

    Git vulnerable to Remote Code Execution while cloning special-crafted local repositories

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been …

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280421
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280428
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4579.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-32002
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-32002
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-32002
  • article
    https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv
  • report
    https://access.redhat.com/security/cve/CVE-2024-32004
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-32004
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-32004
  • article
    https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389