Vulnérabilités / CVE-2024-32002

critique

CVE-2024-32002

git: Recursive clones RCE

Publiée Modifiée CWE 22, 434, 59
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, Azure Linux, Bitnami, CBL-Mariner, Photon OS. Plus basse selon Red Hat (élevée), AlmaLinux (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée), Ubuntu (moyenne).

Description

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
Azure Linux 3.0git0:2.45.2-1.azl3
bitnami::Bitnami Vulnerability Databasegit2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1
CBL-Mariner 2.0git0:2.39.4-1.cm2
Photon OS 3.0git2.39.4-1.ph3
Photon OS 4.0git, git-extras, git-lang2.39.3-1.ph4
Photon OS 5.0git, git-extras, git-lang2.39.3-1.ph5
alma 8git, git-all, git-core et 12 autres2.43.5-1.el8_10
alma 9git, git-all, git-core et 12 autres2.43.5-1.el9_4
alpine 3.17git2.39.5-r0
alpine 3.18git2.40.3-r0
alpine 3.19git2.43.4-r0
alpine 3.20git2.45.1-r0
Afficher les 260 entrées de 49 sources
SourcePaquetCorrigé en
Azure Linux 3.0git0:2.45.2-1.azl3
bitnami::Bitnami Vulnerability Databasegit2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1
CBL-Mariner 2.0git0:2.39.4-1.cm2
Photon OS 3.0git2.39.4-1.ph3
Photon OS 4.0git2.39.3-1.ph4
Photon OS 4.0git-extras2.39.3-1.ph4
Photon OS 4.0git-lang2.39.3-1.ph4
Photon OS 5.0git2.39.3-1.ph5
Photon OS 5.0git-extras2.39.3-1.ph5
Photon OS 5.0git-lang2.39.3-1.ph5
alma 8git2.43.5-1.el8_10
alma 8git-all2.43.5-1.el8_10
alma 8git-core2.43.5-1.el8_10
alma 8git-core-doc2.43.5-1.el8_10
alma 8git-credential-libsecret2.43.5-1.el8_10
alma 8git-daemon2.43.5-1.el8_10
alma 8git-email2.43.5-1.el8_10
alma 8git-gui2.43.5-1.el8_10
alma 8git-instaweb2.43.5-1.el8_10
alma 8git-subtree2.43.5-1.el8_10
alma 8git-svn2.43.5-1.el8_10
alma 8gitk2.43.5-1.el8_10
alma 8gitweb2.43.5-1.el8_10
alma 8perl-Git2.43.5-1.el8_10
alma 8perl-Git-SVN2.43.5-1.el8_10
alma 9git2.43.5-1.el9_4
alma 9git-all2.43.5-1.el9_4
alma 9git-core2.43.5-1.el9_4
alma 9git-core-doc2.43.5-1.el9_4
alma 9git-credential-libsecret2.43.5-1.el9_4
alma 9git-daemon2.43.5-1.el9_4
alma 9git-email2.43.5-1.el9_4
alma 9git-gui2.43.5-1.el9_4
alma 9git-instaweb2.43.5-1.el9_4
alma 9git-subtree2.43.5-1.el9_4
alma 9git-svn2.43.5-1.el9_4
alma 9gitk2.43.5-1.el9_4
alma 9gitweb2.43.5-1.el9_4
alma 9perl-Git2.43.5-1.el9_4
alma 9perl-Git-SVN2.43.5-1.el9_4
alpine 3.17git2.39.5-r0
alpine 3.18git2.40.3-r0
alpine 3.19git2.43.4-r0
alpine 3.20git2.45.1-r0
alpine 3.21git2.45.1-r0
alpine 3.22git2.45.1-r0
alpine 3.23git2.45.1-r0
alpine 3.24git2.45.1-r0
alpine edgegit2.45.1-r0
amazon linux 1emacs-git2.38.4-1.81.amzn1
amazon linux 1emacs-git-el2.38.4-1.81.amzn1
amazon linux 1git2.38.4-1.81.amzn1
amazon linux 1git-all2.38.4-1.81.amzn1
amazon linux 1git-bzr2.38.4-1.81.amzn1
amazon linux 1git-core2.38.4-1.81.amzn1
amazon linux 1git-core-doc2.38.4-1.81.amzn1
amazon linux 1git-cvs2.38.4-1.81.amzn1
amazon linux 1git-daemon2.38.4-1.81.amzn1
amazon linux 1git-debuginfo2.38.4-1.81.amzn1
amazon linux 1git-email2.38.4-1.81.amzn1
amazon linux 1git-hg2.38.4-1.81.amzn1
amazon linux 1git-instaweb2.38.4-1.81.amzn1
amazon linux 1git-p42.38.4-1.81.amzn1
amazon linux 1git-subtree2.38.4-1.81.amzn1
amazon linux 1git-svn2.38.4-1.81.amzn1
amazon linux 1gitweb2.38.4-1.81.amzn1
amazon linux 1perl-Git2.38.4-1.81.amzn1
amazon linux 1perl-Git-SVN2.38.4-1.81.amzn1
amazon linux 2git2.40.1-1.amzn2.0.3
amazon linux 2git-all2.40.1-1.amzn2.0.3
amazon linux 2git-core2.40.1-1.amzn2.0.3
amazon linux 2git-core-doc2.40.1-1.amzn2.0.3
amazon linux 2git-credential-libsecret2.40.1-1.amzn2.0.3
amazon linux 2git-cvs2.40.1-1.amzn2.0.3
amazon linux 2git-daemon2.40.1-1.amzn2.0.3
amazon linux 2git-debuginfo2.40.1-1.amzn2.0.3
amazon linux 2git-email2.40.1-1.amzn2.0.3
amazon linux 2git-gui2.40.1-1.amzn2.0.3
amazon linux 2git-instaweb2.40.1-1.amzn2.0.3
amazon linux 2git-p42.40.1-1.amzn2.0.3
amazon linux 2git-subtree2.40.1-1.amzn2.0.3
amazon linux 2git-svn2.40.1-1.amzn2.0.3
amazon linux 2gitk2.40.1-1.amzn2.0.3
amazon linux 2gitweb2.40.1-1.amzn2.0.3
amazon linux 2perl-Git2.40.1-1.amzn2.0.3
amazon linux 2perl-Git-SVN2.40.1-1.amzn2.0.3
amazon linux 2023git2.40.1-1.amzn2023.0.3
amazon linux 2023git-all2.40.1-1.amzn2023.0.3
amazon linux 2023git-core2.40.1-1.amzn2023.0.3
amazon linux 2023git-core-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-core-doc2.40.1-1.amzn2023.0.3
amazon linux 2023git-credential-libsecret2.40.1-1.amzn2023.0.3
amazon linux 2023git-credential-libsecret-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-cvs2.40.1-1.amzn2023.0.3
amazon linux 2023git-daemon2.40.1-1.amzn2023.0.3
amazon linux 2023git-daemon-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-debugsource2.40.1-1.amzn2023.0.3
amazon linux 2023git-email2.40.1-1.amzn2023.0.3
amazon linux 2023git-gui2.40.1-1.amzn2023.0.3
amazon linux 2023git-instaweb2.40.1-1.amzn2023.0.3
amazon linux 2023git-p42.40.1-1.amzn2023.0.3
amazon linux 2023git-subtree2.40.1-1.amzn2023.0.3
amazon linux 2023git-svn2.40.1-1.amzn2023.0.3
amazon linux 2023gitk2.40.1-1.amzn2023.0.3
amazon linux 2023gitweb2.40.1-1.amzn2023.0.3
amazon linux 2023perl-Git2.40.1-1.amzn2023.0.3
amazon linux 2023perl-Git-SVN2.40.1-1.amzn2023.0.3
chainguardgit2.45.1-r0
debian 10git1:2.20.1-2+deb10u9
debian 11git1:2.30.2-1+deb11u3
debian 12git1:2.39.5-0+deb12u1
debian 13git1:2.45.1-1
debian 14git1:2.45.1-1
echogit1:2.39.5-0+deb12u1
Oracle Linux 8git2.43.5-1.el8_10
Oracle Linux 8git-all2.43.5-1.el8_10
Oracle Linux 8git-core2.43.5-1.el8_10
Oracle Linux 8git-core-doc2.43.5-1.el8_10
Oracle Linux 8git-credential-libsecret2.43.5-1.el8_10
Oracle Linux 8git-daemon2.43.5-1.el8_10
Oracle Linux 8git-email2.43.5-1.el8_10
Oracle Linux 8git-gui2.43.5-1.el8_10
Oracle Linux 8git-instaweb2.43.5-1.el8_10
Oracle Linux 8git-subtree2.43.5-1.el8_10
Oracle Linux 8git-svn2.43.5-1.el8_10
Oracle Linux 8gitk2.43.5-1.el8_10
Oracle Linux 8gitweb2.43.5-1.el8_10
Oracle Linux 8perl-Git2.43.5-1.el8_10
Oracle Linux 8perl-Git-SVN2.43.5-1.el8_10
Oracle Linux 9git2.43.5-1.el9_4
Oracle Linux 9git-all2.43.5-1.el9_4
Oracle Linux 9git-core2.43.5-1.el9_4
Oracle Linux 9git-core-doc2.43.5-1.el9_4
Oracle Linux 9git-credential-libsecret2.43.5-1.el9_4
Oracle Linux 9git-daemon2.43.5-1.el9_4
Oracle Linux 9git-email2.43.5-1.el9_4
Oracle Linux 9git-gui2.43.5-1.el9_4
Oracle Linux 9git-instaweb2.43.5-1.el9_4
Oracle Linux 9git-subtree2.43.5-1.el9_4
Oracle Linux 9git-svn2.43.5-1.el9_4
Oracle Linux 9gitk2.43.5-1.el9_4
Oracle Linux 9gitweb2.43.5-1.el9_4
Oracle Linux 9perl-Git2.43.5-1.el9_4
Oracle Linux 9perl-Git-SVN2.43.5-1.el9_4
rapidfort amazon linux 2023git2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-all2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-core2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-core-doc2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-credential-libsecret2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-cvs2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-daemon2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-email2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-gui2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-instaweb2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-p42.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-subtree2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-svn2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023gitk2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023gitweb2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023perl-Git2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023perl-Git-SVN2.40.1-1.amzn2023.0.3
rapidfort Oracle Linux 9git0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-all0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-core0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-core-doc0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-credential-libsecret0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-daemon0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-email0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-gui0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-instaweb0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-subtree0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-svn0:2.43.5-1.el9_4
rapidfort Oracle Linux 9gitk0:2.43.5-1.el9_4
rapidfort Oracle Linux 9gitweb0:2.43.5-1.el9_4
rapidfort Oracle Linux 9perl-Git0:2.43.5-1.el9_4
rapidfort Oracle Linux 9perl-Git-SVN0:2.43.5-1.el9_4
rapidfort ubuntu 20.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 20.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 22.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 22.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 24.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 24.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
Red Hatemacs-gitpas de correctif indiqué
Red Hatemacs-git-elpas de correctif indiqué
Red Hatgitpas de correctif indiqué
Red Hatgit-allpas de correctif indiqué
Red Hatgit-bzrpas de correctif indiqué
Red Hatgit-cvspas de correctif indiqué
Red Hatgit-daemonpas de correctif indiqué
Red Hatgit-emailpas de correctif indiqué
Red Hatgit-gnome-keyringpas de correctif indiqué
Red Hatgit-guipas de correctif indiqué
Red Hatgit-hgpas de correctif indiqué
Red Hatgit-instawebpas de correctif indiqué
Red Hatgit-p4pas de correctif indiqué
Red Hatgit-svnpas de correctif indiqué
Red Hatgitkpas de correctif indiqué
Red Hatgitwebpas de correctif indiqué
Red Hatperl-Gitpas de correctif indiqué
Red Hatperl-Git-SVNpas de correctif indiqué
Red Hatrh-git227-gitpas de correctif indiqué
Red Hatrh-git227-git-allpas de correctif indiqué
Red Hatrh-git227-git-corepas de correctif indiqué
Red Hatrh-git227-git-core-docpas de correctif indiqué
Red Hatrh-git227-git-credential-libsecretpas de correctif indiqué
Red Hatrh-git227-git-cvspas de correctif indiqué
Red Hatrh-git227-git-daemonpas de correctif indiqué
Red Hatrh-git227-git-emailpas de correctif indiqué
Red Hatrh-git227-git-guipas de correctif indiqué
Red Hatrh-git227-git-instawebpas de correctif indiqué
Red Hatrh-git227-git-p4pas de correctif indiqué
Red Hatrh-git227-git-subtreepas de correctif indiqué
Red Hatrh-git227-git-svnpas de correctif indiqué
Red Hatrh-git227-gitkpas de correctif indiqué
Red Hatrh-git227-gitwebpas de correctif indiqué
Red Hatrh-git227-perl-Gitpas de correctif indiqué
Red Hatrh-git227-perl-Git-SVNpas de correctif indiqué
rocky 8git2.43.5-1.el8_10
rocky 8git-all2.43.5-1.el8_10
rocky 8git-core2.43.5-1.el8_10
rocky 8git-core-doc2.43.5-1.el8_10
rocky 8git-credential-libsecret2.43.5-1.el8_10
rocky 8git-daemon2.43.5-1.el8_10
rocky 8git-email2.43.5-1.el8_10
rocky 8git-gui2.43.5-1.el8_10
rocky 8git-instaweb2.43.5-1.el8_10
rocky 8git-subtree2.43.5-1.el8_10
rocky 8git-svn2.43.5-1.el8_10
rocky 8gitk2.43.5-1.el8_10
rocky 8gitweb2.43.5-1.el8_10
rocky 8perl-Git2.43.5-1.el8_10
rocky 8perl-Git-SVN2.43.5-1.el8_10
rocky 9git2.43.5-1.el9_4
rocky 9git-all2.43.5-1.el9_4
rocky 9git-core2.43.5-1.el9_4
rocky 9git-core-doc2.43.5-1.el9_4
rocky 9git-credential-libsecret2.43.5-1.el9_4
rocky 9git-daemon2.43.5-1.el9_4
rocky 9git-email2.43.5-1.el9_4
rocky 9git-gui2.43.5-1.el9_4
rocky 9git-instaweb2.43.5-1.el9_4
rocky 9git-subtree2.43.5-1.el9_4
rocky 9git-svn2.43.5-1.el9_4
rocky 9gitk2.43.5-1.el9_4
rocky 9gitweb2.43.5-1.el9_4
rocky 9perl-Git2.43.5-1.el9_4
rocky 9perl-Git-SVN2.43.5-1.el9_4
root.io debian 11rootio-git1:2.30.2-1+deb11u3
root.io debian 12rootio-git1:2.39.5-0+deb12u1
root.io debian 13rootio-git1:2.45.1-1
root.io ubuntu 22.04rootio-git1:2.34.1-1ubuntu1.11
root.io ubuntu 24.04rootio-git1:2.43.0-1ubuntu7.1
ubuntu 18.04-ESMgit1:2.17.1-1ubuntu0.18+esm1
ubuntu 20.04git1:2.25.1-1ubuntu3.13
ubuntu 20.04-ESMgit1:2.25.1-1ubuntu3.13
ubuntu 22.04git1:2.34.1-1ubuntu1.11
ubuntu 23.10git1:2.40.1-1ubuntu1.1
ubuntu 24.04git1:2.43.0-1ubuntu7.1
wolfigit2.45.1-r0

Références

Les 35 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.