Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2024-32002

crítica

CVE-2024-32002

git: Recursive clones RCE

Publicada Modificada CWE 22, 434, 59
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Azure Linux, Bitnami, CBL-Mariner, Photon OS. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).

Descripción

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
Azure Linux 3.0git0:2.45.2-1.azl3
bitnami::Bitnami Vulnerability Databasegit2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1
CBL-Mariner 2.0git0:2.39.4-1.cm2
Photon OS 3.0git2.39.4-1.ph3
Photon OS 4.0git, git-extras, git-lang2.39.3-1.ph4
Photon OS 5.0git, git-extras, git-lang2.39.3-1.ph5
alma 8git, git-all, git-core y 12 más2.43.5-1.el8_10
alma 9git, git-all, git-core y 12 más2.43.5-1.el9_4
alpine 3.17git2.39.5-r0
alpine 3.18git2.40.3-r0
alpine 3.19git2.43.4-r0
alpine 3.20git2.45.1-r0
Mostrar las 260 entradas de 49 fuentes
FuentePaqueteCorregido en
Azure Linux 3.0git0:2.45.2-1.azl3
bitnami::Bitnami Vulnerability Databasegit2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1
CBL-Mariner 2.0git0:2.39.4-1.cm2
Photon OS 3.0git2.39.4-1.ph3
Photon OS 4.0git2.39.3-1.ph4
Photon OS 4.0git-extras2.39.3-1.ph4
Photon OS 4.0git-lang2.39.3-1.ph4
Photon OS 5.0git2.39.3-1.ph5
Photon OS 5.0git-extras2.39.3-1.ph5
Photon OS 5.0git-lang2.39.3-1.ph5
alma 8git2.43.5-1.el8_10
alma 8git-all2.43.5-1.el8_10
alma 8git-core2.43.5-1.el8_10
alma 8git-core-doc2.43.5-1.el8_10
alma 8git-credential-libsecret2.43.5-1.el8_10
alma 8git-daemon2.43.5-1.el8_10
alma 8git-email2.43.5-1.el8_10
alma 8git-gui2.43.5-1.el8_10
alma 8git-instaweb2.43.5-1.el8_10
alma 8git-subtree2.43.5-1.el8_10
alma 8git-svn2.43.5-1.el8_10
alma 8gitk2.43.5-1.el8_10
alma 8gitweb2.43.5-1.el8_10
alma 8perl-Git2.43.5-1.el8_10
alma 8perl-Git-SVN2.43.5-1.el8_10
alma 9git2.43.5-1.el9_4
alma 9git-all2.43.5-1.el9_4
alma 9git-core2.43.5-1.el9_4
alma 9git-core-doc2.43.5-1.el9_4
alma 9git-credential-libsecret2.43.5-1.el9_4
alma 9git-daemon2.43.5-1.el9_4
alma 9git-email2.43.5-1.el9_4
alma 9git-gui2.43.5-1.el9_4
alma 9git-instaweb2.43.5-1.el9_4
alma 9git-subtree2.43.5-1.el9_4
alma 9git-svn2.43.5-1.el9_4
alma 9gitk2.43.5-1.el9_4
alma 9gitweb2.43.5-1.el9_4
alma 9perl-Git2.43.5-1.el9_4
alma 9perl-Git-SVN2.43.5-1.el9_4
alpine 3.17git2.39.5-r0
alpine 3.18git2.40.3-r0
alpine 3.19git2.43.4-r0
alpine 3.20git2.45.1-r0
alpine 3.21git2.45.1-r0
alpine 3.22git2.45.1-r0
alpine 3.23git2.45.1-r0
alpine 3.24git2.45.1-r0
alpine edgegit2.45.1-r0
amazon linux 1emacs-git2.38.4-1.81.amzn1
amazon linux 1emacs-git-el2.38.4-1.81.amzn1
amazon linux 1git2.38.4-1.81.amzn1
amazon linux 1git-all2.38.4-1.81.amzn1
amazon linux 1git-bzr2.38.4-1.81.amzn1
amazon linux 1git-core2.38.4-1.81.amzn1
amazon linux 1git-core-doc2.38.4-1.81.amzn1
amazon linux 1git-cvs2.38.4-1.81.amzn1
amazon linux 1git-daemon2.38.4-1.81.amzn1
amazon linux 1git-debuginfo2.38.4-1.81.amzn1
amazon linux 1git-email2.38.4-1.81.amzn1
amazon linux 1git-hg2.38.4-1.81.amzn1
amazon linux 1git-instaweb2.38.4-1.81.amzn1
amazon linux 1git-p42.38.4-1.81.amzn1
amazon linux 1git-subtree2.38.4-1.81.amzn1
amazon linux 1git-svn2.38.4-1.81.amzn1
amazon linux 1gitweb2.38.4-1.81.amzn1
amazon linux 1perl-Git2.38.4-1.81.amzn1
amazon linux 1perl-Git-SVN2.38.4-1.81.amzn1
amazon linux 2git2.40.1-1.amzn2.0.3
amazon linux 2git-all2.40.1-1.amzn2.0.3
amazon linux 2git-core2.40.1-1.amzn2.0.3
amazon linux 2git-core-doc2.40.1-1.amzn2.0.3
amazon linux 2git-credential-libsecret2.40.1-1.amzn2.0.3
amazon linux 2git-cvs2.40.1-1.amzn2.0.3
amazon linux 2git-daemon2.40.1-1.amzn2.0.3
amazon linux 2git-debuginfo2.40.1-1.amzn2.0.3
amazon linux 2git-email2.40.1-1.amzn2.0.3
amazon linux 2git-gui2.40.1-1.amzn2.0.3
amazon linux 2git-instaweb2.40.1-1.amzn2.0.3
amazon linux 2git-p42.40.1-1.amzn2.0.3
amazon linux 2git-subtree2.40.1-1.amzn2.0.3
amazon linux 2git-svn2.40.1-1.amzn2.0.3
amazon linux 2gitk2.40.1-1.amzn2.0.3
amazon linux 2gitweb2.40.1-1.amzn2.0.3
amazon linux 2perl-Git2.40.1-1.amzn2.0.3
amazon linux 2perl-Git-SVN2.40.1-1.amzn2.0.3
amazon linux 2023git2.40.1-1.amzn2023.0.3
amazon linux 2023git-all2.40.1-1.amzn2023.0.3
amazon linux 2023git-core2.40.1-1.amzn2023.0.3
amazon linux 2023git-core-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-core-doc2.40.1-1.amzn2023.0.3
amazon linux 2023git-credential-libsecret2.40.1-1.amzn2023.0.3
amazon linux 2023git-credential-libsecret-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-cvs2.40.1-1.amzn2023.0.3
amazon linux 2023git-daemon2.40.1-1.amzn2023.0.3
amazon linux 2023git-daemon-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-debugsource2.40.1-1.amzn2023.0.3
amazon linux 2023git-email2.40.1-1.amzn2023.0.3
amazon linux 2023git-gui2.40.1-1.amzn2023.0.3
amazon linux 2023git-instaweb2.40.1-1.amzn2023.0.3
amazon linux 2023git-p42.40.1-1.amzn2023.0.3
amazon linux 2023git-subtree2.40.1-1.amzn2023.0.3
amazon linux 2023git-svn2.40.1-1.amzn2023.0.3
amazon linux 2023gitk2.40.1-1.amzn2023.0.3
amazon linux 2023gitweb2.40.1-1.amzn2023.0.3
amazon linux 2023perl-Git2.40.1-1.amzn2023.0.3
amazon linux 2023perl-Git-SVN2.40.1-1.amzn2023.0.3
chainguardgit2.45.1-r0
debian 10git1:2.20.1-2+deb10u9
debian 11git1:2.30.2-1+deb11u3
debian 12git1:2.39.5-0+deb12u1
debian 13git1:2.45.1-1
debian 14git1:2.45.1-1
echogit1:2.39.5-0+deb12u1
Oracle Linux 8git2.43.5-1.el8_10
Oracle Linux 8git-all2.43.5-1.el8_10
Oracle Linux 8git-core2.43.5-1.el8_10
Oracle Linux 8git-core-doc2.43.5-1.el8_10
Oracle Linux 8git-credential-libsecret2.43.5-1.el8_10
Oracle Linux 8git-daemon2.43.5-1.el8_10
Oracle Linux 8git-email2.43.5-1.el8_10
Oracle Linux 8git-gui2.43.5-1.el8_10
Oracle Linux 8git-instaweb2.43.5-1.el8_10
Oracle Linux 8git-subtree2.43.5-1.el8_10
Oracle Linux 8git-svn2.43.5-1.el8_10
Oracle Linux 8gitk2.43.5-1.el8_10
Oracle Linux 8gitweb2.43.5-1.el8_10
Oracle Linux 8perl-Git2.43.5-1.el8_10
Oracle Linux 8perl-Git-SVN2.43.5-1.el8_10
Oracle Linux 9git2.43.5-1.el9_4
Oracle Linux 9git-all2.43.5-1.el9_4
Oracle Linux 9git-core2.43.5-1.el9_4
Oracle Linux 9git-core-doc2.43.5-1.el9_4
Oracle Linux 9git-credential-libsecret2.43.5-1.el9_4
Oracle Linux 9git-daemon2.43.5-1.el9_4
Oracle Linux 9git-email2.43.5-1.el9_4
Oracle Linux 9git-gui2.43.5-1.el9_4
Oracle Linux 9git-instaweb2.43.5-1.el9_4
Oracle Linux 9git-subtree2.43.5-1.el9_4
Oracle Linux 9git-svn2.43.5-1.el9_4
Oracle Linux 9gitk2.43.5-1.el9_4
Oracle Linux 9gitweb2.43.5-1.el9_4
Oracle Linux 9perl-Git2.43.5-1.el9_4
Oracle Linux 9perl-Git-SVN2.43.5-1.el9_4
rapidfort amazon linux 2023git2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-all2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-core2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-core-doc2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-credential-libsecret2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-cvs2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-daemon2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-email2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-gui2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-instaweb2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-p42.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-subtree2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-svn2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023gitk2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023gitweb2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023perl-Git2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023perl-Git-SVN2.40.1-1.amzn2023.0.3
rapidfort Oracle Linux 9git0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-all0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-core0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-core-doc0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-credential-libsecret0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-daemon0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-email0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-gui0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-instaweb0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-subtree0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-svn0:2.43.5-1.el9_4
rapidfort Oracle Linux 9gitk0:2.43.5-1.el9_4
rapidfort Oracle Linux 9gitweb0:2.43.5-1.el9_4
rapidfort Oracle Linux 9perl-Git0:2.43.5-1.el9_4
rapidfort Oracle Linux 9perl-Git-SVN0:2.43.5-1.el9_4
rapidfort ubuntu 20.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 20.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 22.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 22.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 24.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 24.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
Red Hatemacs-gitsin corrección indicada
Red Hatemacs-git-elsin corrección indicada
Red Hatgitsin corrección indicada
Red Hatgit-allsin corrección indicada
Red Hatgit-bzrsin corrección indicada
Red Hatgit-cvssin corrección indicada
Red Hatgit-daemonsin corrección indicada
Red Hatgit-emailsin corrección indicada
Red Hatgit-gnome-keyringsin corrección indicada
Red Hatgit-guisin corrección indicada
Red Hatgit-hgsin corrección indicada
Red Hatgit-instawebsin corrección indicada
Red Hatgit-p4sin corrección indicada
Red Hatgit-svnsin corrección indicada
Red Hatgitksin corrección indicada
Red Hatgitwebsin corrección indicada
Red Hatperl-Gitsin corrección indicada
Red Hatperl-Git-SVNsin corrección indicada
Red Hatrh-git227-gitsin corrección indicada
Red Hatrh-git227-git-allsin corrección indicada
Red Hatrh-git227-git-coresin corrección indicada
Red Hatrh-git227-git-core-docsin corrección indicada
Red Hatrh-git227-git-credential-libsecretsin corrección indicada
Red Hatrh-git227-git-cvssin corrección indicada
Red Hatrh-git227-git-daemonsin corrección indicada
Red Hatrh-git227-git-emailsin corrección indicada
Red Hatrh-git227-git-guisin corrección indicada
Red Hatrh-git227-git-instawebsin corrección indicada
Red Hatrh-git227-git-p4sin corrección indicada
Red Hatrh-git227-git-subtreesin corrección indicada
Red Hatrh-git227-git-svnsin corrección indicada
Red Hatrh-git227-gitksin corrección indicada
Red Hatrh-git227-gitwebsin corrección indicada
Red Hatrh-git227-perl-Gitsin corrección indicada
Red Hatrh-git227-perl-Git-SVNsin corrección indicada
rocky 8git2.43.5-1.el8_10
rocky 8git-all2.43.5-1.el8_10
rocky 8git-core2.43.5-1.el8_10
rocky 8git-core-doc2.43.5-1.el8_10
rocky 8git-credential-libsecret2.43.5-1.el8_10
rocky 8git-daemon2.43.5-1.el8_10
rocky 8git-email2.43.5-1.el8_10
rocky 8git-gui2.43.5-1.el8_10
rocky 8git-instaweb2.43.5-1.el8_10
rocky 8git-subtree2.43.5-1.el8_10
rocky 8git-svn2.43.5-1.el8_10
rocky 8gitk2.43.5-1.el8_10
rocky 8gitweb2.43.5-1.el8_10
rocky 8perl-Git2.43.5-1.el8_10
rocky 8perl-Git-SVN2.43.5-1.el8_10
rocky 9git2.43.5-1.el9_4
rocky 9git-all2.43.5-1.el9_4
rocky 9git-core2.43.5-1.el9_4
rocky 9git-core-doc2.43.5-1.el9_4
rocky 9git-credential-libsecret2.43.5-1.el9_4
rocky 9git-daemon2.43.5-1.el9_4
rocky 9git-email2.43.5-1.el9_4
rocky 9git-gui2.43.5-1.el9_4
rocky 9git-instaweb2.43.5-1.el9_4
rocky 9git-subtree2.43.5-1.el9_4
rocky 9git-svn2.43.5-1.el9_4
rocky 9gitk2.43.5-1.el9_4
rocky 9gitweb2.43.5-1.el9_4
rocky 9perl-Git2.43.5-1.el9_4
rocky 9perl-Git-SVN2.43.5-1.el9_4
root.io debian 11rootio-git1:2.30.2-1+deb11u3
root.io debian 12rootio-git1:2.39.5-0+deb12u1
root.io debian 13rootio-git1:2.45.1-1
root.io ubuntu 22.04rootio-git1:2.34.1-1ubuntu1.11
root.io ubuntu 24.04rootio-git1:2.43.0-1ubuntu7.1
ubuntu 18.04-ESMgit1:2.17.1-1ubuntu0.18+esm1
ubuntu 20.04git1:2.25.1-1ubuntu3.13
ubuntu 20.04-ESMgit1:2.25.1-1ubuntu3.13
ubuntu 22.04git1:2.34.1-1ubuntu1.11
ubuntu 23.10git1:2.40.1-1ubuntu1.1
ubuntu 24.04git1:2.43.0-1ubuntu7.1
wolfigit2.45.1-r0

Referencias

Las 35 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.