Summary
Maxime Escourbiac and Yassine Bengana discovered that Git incorrectly
handled some gettext machinery. An attacker could possibly use this issue
to allows the malicious placement of crafted messages. This issue was fixed
in Ubuntu 16.04 LTS. (CVE-2023-25815)
It was discovered that Git incorrectly handled certain submodules.
An attacker could possibly use this issue to execute arbitrary code.
This issue was fixed in Ubuntu 18.04 LTS. (CVE-2024-32002)
It was discovered that Git incorrectly handled certain cloned repositories.
An attacker could possibly use this issue to execute arbitrary code. This
issue was fixed in Ubuntu 18.04 LTS. (CVE-2024-32004, CVE-2024-32465)
It was discovered that Git incorrectly handled local clones with hardlinked
files/directories. An attacker could possibly use this issue to place a
specialized repository on their target’s local system. This issue was fixed
in Ubuntu 18.04 LTS. (CVE-2024-32020)
It was discovered that Git incorrectly handled certain symlinks. An
attacker could possibly use this issue to impact availability and
integrity creating hardlinked arbitrary files into users repository’s
objects/directory. This issue was fixed in Ubuntu 18.04 LTS.
(CVE-2024-32021)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | git | 1:2.7.4-0ubuntu1.10+esm8 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | git | 1:2.17.1-1ubuntu0.18+esm1 |
Vulnerabilities 6
-
Critical 9.1
Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule'…
-
High 8.2CVE-2024-32004 Public exploit
Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been …
-
High 7.4
Git's protections for cloning untrusted repositories can be bypassed
Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an …
-
Low 3.9
Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. I…
-
Low 3.9
Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the …
-
Low 3.3
Git looks for localized messages in the wrong place
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…