Skip to content
OpenAdvisories
Critical RHSA-2024:6028 2 CVEs

Red Hat Security Advisory: git security update

Published Sep 18, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 60

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-all 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-core 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-core-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-core-doc 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-credential-libsecret 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-credential-libsecret-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-daemon 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-daemon-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-debugsource 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-email 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-gui 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-instaweb 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-subtree 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream git-svn 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream gitk 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream gitweb 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream perl-Git 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream perl-Git-SVN 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-all 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-core 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-core-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-core-doc 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-credential-libsecret 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-credential-libsecret-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-daemon 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-daemon-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-debugsource 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-email 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-gui 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-instaweb 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-subtree 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream git-svn 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream gitk 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream gitweb 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream perl-Git 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream perl-Git-SVN 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-all 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-core 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-core-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-core-doc 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-credential-libsecret 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-credential-libsecret-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-daemon 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-daemon-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-debuginfo 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-debugsource 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-email 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-gui 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-instaweb 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-subtree 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream git-svn 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream gitk 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream gitweb 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream perl-Git 0:2.27.0-5.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream perl-Git-SVN 0:2.27.0-5.el8_4

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-32002 Public exploit EPSS 29%

    Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule'…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2024-32004 Public exploit

    Git vulnerable to Remote Code Execution while cloning special-crafted local repositories

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been …

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280421
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280428
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6028.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-32002
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-32002
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-32002
  • article
    https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv
  • report
    https://access.redhat.com/security/cve/CVE-2024-32004
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-32004
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-32004
  • article
    https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389