Zafiyetler / CVE-2024-32002

kritik

CVE-2024-32002

git: Recursive clones RCE

Yayın Değişiklik CWE 22, 434, 59
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Azure Linux, Bitnami, CBL-Mariner, Photon OS. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).

Açıklama

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
Azure Linux 3.0git0:2.45.2-1.azl3
bitnami::Bitnami Vulnerability Databasegit2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1
CBL-Mariner 2.0git0:2.39.4-1.cm2
Photon OS 3.0git2.39.4-1.ph3
Photon OS 4.0git, git-extras, git-lang2.39.3-1.ph4
Photon OS 5.0git, git-extras, git-lang2.39.3-1.ph5
alma 8git, git-all, git-core ve 12 tane daha2.43.5-1.el8_10
alma 9git, git-all, git-core ve 12 tane daha2.43.5-1.el9_4
alpine 3.17git2.39.5-r0
alpine 3.18git2.40.3-r0
alpine 3.19git2.43.4-r0
alpine 3.20git2.45.1-r0
49 kaynaktaki 260 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
Azure Linux 3.0git0:2.45.2-1.azl3
bitnami::Bitnami Vulnerability Databasegit2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1
CBL-Mariner 2.0git0:2.39.4-1.cm2
Photon OS 3.0git2.39.4-1.ph3
Photon OS 4.0git2.39.3-1.ph4
Photon OS 4.0git-extras2.39.3-1.ph4
Photon OS 4.0git-lang2.39.3-1.ph4
Photon OS 5.0git2.39.3-1.ph5
Photon OS 5.0git-extras2.39.3-1.ph5
Photon OS 5.0git-lang2.39.3-1.ph5
alma 8git2.43.5-1.el8_10
alma 8git-all2.43.5-1.el8_10
alma 8git-core2.43.5-1.el8_10
alma 8git-core-doc2.43.5-1.el8_10
alma 8git-credential-libsecret2.43.5-1.el8_10
alma 8git-daemon2.43.5-1.el8_10
alma 8git-email2.43.5-1.el8_10
alma 8git-gui2.43.5-1.el8_10
alma 8git-instaweb2.43.5-1.el8_10
alma 8git-subtree2.43.5-1.el8_10
alma 8git-svn2.43.5-1.el8_10
alma 8gitk2.43.5-1.el8_10
alma 8gitweb2.43.5-1.el8_10
alma 8perl-Git2.43.5-1.el8_10
alma 8perl-Git-SVN2.43.5-1.el8_10
alma 9git2.43.5-1.el9_4
alma 9git-all2.43.5-1.el9_4
alma 9git-core2.43.5-1.el9_4
alma 9git-core-doc2.43.5-1.el9_4
alma 9git-credential-libsecret2.43.5-1.el9_4
alma 9git-daemon2.43.5-1.el9_4
alma 9git-email2.43.5-1.el9_4
alma 9git-gui2.43.5-1.el9_4
alma 9git-instaweb2.43.5-1.el9_4
alma 9git-subtree2.43.5-1.el9_4
alma 9git-svn2.43.5-1.el9_4
alma 9gitk2.43.5-1.el9_4
alma 9gitweb2.43.5-1.el9_4
alma 9perl-Git2.43.5-1.el9_4
alma 9perl-Git-SVN2.43.5-1.el9_4
alpine 3.17git2.39.5-r0
alpine 3.18git2.40.3-r0
alpine 3.19git2.43.4-r0
alpine 3.20git2.45.1-r0
alpine 3.21git2.45.1-r0
alpine 3.22git2.45.1-r0
alpine 3.23git2.45.1-r0
alpine 3.24git2.45.1-r0
alpine edgegit2.45.1-r0
amazon linux 1emacs-git2.38.4-1.81.amzn1
amazon linux 1emacs-git-el2.38.4-1.81.amzn1
amazon linux 1git2.38.4-1.81.amzn1
amazon linux 1git-all2.38.4-1.81.amzn1
amazon linux 1git-bzr2.38.4-1.81.amzn1
amazon linux 1git-core2.38.4-1.81.amzn1
amazon linux 1git-core-doc2.38.4-1.81.amzn1
amazon linux 1git-cvs2.38.4-1.81.amzn1
amazon linux 1git-daemon2.38.4-1.81.amzn1
amazon linux 1git-debuginfo2.38.4-1.81.amzn1
amazon linux 1git-email2.38.4-1.81.amzn1
amazon linux 1git-hg2.38.4-1.81.amzn1
amazon linux 1git-instaweb2.38.4-1.81.amzn1
amazon linux 1git-p42.38.4-1.81.amzn1
amazon linux 1git-subtree2.38.4-1.81.amzn1
amazon linux 1git-svn2.38.4-1.81.amzn1
amazon linux 1gitweb2.38.4-1.81.amzn1
amazon linux 1perl-Git2.38.4-1.81.amzn1
amazon linux 1perl-Git-SVN2.38.4-1.81.amzn1
amazon linux 2git2.40.1-1.amzn2.0.3
amazon linux 2git-all2.40.1-1.amzn2.0.3
amazon linux 2git-core2.40.1-1.amzn2.0.3
amazon linux 2git-core-doc2.40.1-1.amzn2.0.3
amazon linux 2git-credential-libsecret2.40.1-1.amzn2.0.3
amazon linux 2git-cvs2.40.1-1.amzn2.0.3
amazon linux 2git-daemon2.40.1-1.amzn2.0.3
amazon linux 2git-debuginfo2.40.1-1.amzn2.0.3
amazon linux 2git-email2.40.1-1.amzn2.0.3
amazon linux 2git-gui2.40.1-1.amzn2.0.3
amazon linux 2git-instaweb2.40.1-1.amzn2.0.3
amazon linux 2git-p42.40.1-1.amzn2.0.3
amazon linux 2git-subtree2.40.1-1.amzn2.0.3
amazon linux 2git-svn2.40.1-1.amzn2.0.3
amazon linux 2gitk2.40.1-1.amzn2.0.3
amazon linux 2gitweb2.40.1-1.amzn2.0.3
amazon linux 2perl-Git2.40.1-1.amzn2.0.3
amazon linux 2perl-Git-SVN2.40.1-1.amzn2.0.3
amazon linux 2023git2.40.1-1.amzn2023.0.3
amazon linux 2023git-all2.40.1-1.amzn2023.0.3
amazon linux 2023git-core2.40.1-1.amzn2023.0.3
amazon linux 2023git-core-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-core-doc2.40.1-1.amzn2023.0.3
amazon linux 2023git-credential-libsecret2.40.1-1.amzn2023.0.3
amazon linux 2023git-credential-libsecret-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-cvs2.40.1-1.amzn2023.0.3
amazon linux 2023git-daemon2.40.1-1.amzn2023.0.3
amazon linux 2023git-daemon-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-debuginfo2.40.1-1.amzn2023.0.3
amazon linux 2023git-debugsource2.40.1-1.amzn2023.0.3
amazon linux 2023git-email2.40.1-1.amzn2023.0.3
amazon linux 2023git-gui2.40.1-1.amzn2023.0.3
amazon linux 2023git-instaweb2.40.1-1.amzn2023.0.3
amazon linux 2023git-p42.40.1-1.amzn2023.0.3
amazon linux 2023git-subtree2.40.1-1.amzn2023.0.3
amazon linux 2023git-svn2.40.1-1.amzn2023.0.3
amazon linux 2023gitk2.40.1-1.amzn2023.0.3
amazon linux 2023gitweb2.40.1-1.amzn2023.0.3
amazon linux 2023perl-Git2.40.1-1.amzn2023.0.3
amazon linux 2023perl-Git-SVN2.40.1-1.amzn2023.0.3
chainguardgit2.45.1-r0
debian 10git1:2.20.1-2+deb10u9
debian 11git1:2.30.2-1+deb11u3
debian 12git1:2.39.5-0+deb12u1
debian 13git1:2.45.1-1
debian 14git1:2.45.1-1
echogit1:2.39.5-0+deb12u1
Oracle Linux 8git2.43.5-1.el8_10
Oracle Linux 8git-all2.43.5-1.el8_10
Oracle Linux 8git-core2.43.5-1.el8_10
Oracle Linux 8git-core-doc2.43.5-1.el8_10
Oracle Linux 8git-credential-libsecret2.43.5-1.el8_10
Oracle Linux 8git-daemon2.43.5-1.el8_10
Oracle Linux 8git-email2.43.5-1.el8_10
Oracle Linux 8git-gui2.43.5-1.el8_10
Oracle Linux 8git-instaweb2.43.5-1.el8_10
Oracle Linux 8git-subtree2.43.5-1.el8_10
Oracle Linux 8git-svn2.43.5-1.el8_10
Oracle Linux 8gitk2.43.5-1.el8_10
Oracle Linux 8gitweb2.43.5-1.el8_10
Oracle Linux 8perl-Git2.43.5-1.el8_10
Oracle Linux 8perl-Git-SVN2.43.5-1.el8_10
Oracle Linux 9git2.43.5-1.el9_4
Oracle Linux 9git-all2.43.5-1.el9_4
Oracle Linux 9git-core2.43.5-1.el9_4
Oracle Linux 9git-core-doc2.43.5-1.el9_4
Oracle Linux 9git-credential-libsecret2.43.5-1.el9_4
Oracle Linux 9git-daemon2.43.5-1.el9_4
Oracle Linux 9git-email2.43.5-1.el9_4
Oracle Linux 9git-gui2.43.5-1.el9_4
Oracle Linux 9git-instaweb2.43.5-1.el9_4
Oracle Linux 9git-subtree2.43.5-1.el9_4
Oracle Linux 9git-svn2.43.5-1.el9_4
Oracle Linux 9gitk2.43.5-1.el9_4
Oracle Linux 9gitweb2.43.5-1.el9_4
Oracle Linux 9perl-Git2.43.5-1.el9_4
Oracle Linux 9perl-Git-SVN2.43.5-1.el9_4
rapidfort amazon linux 2023git2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-all2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-core2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-core-doc2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-credential-libsecret2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-cvs2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-daemon2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-email2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-gui2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-instaweb2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-p42.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-subtree2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023git-svn2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023gitk2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023gitweb2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023perl-Git2.40.1-1.amzn2023.0.3
rapidfort amazon linux 2023perl-Git-SVN2.40.1-1.amzn2023.0.3
rapidfort Oracle Linux 9git0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-all0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-core0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-core-doc0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-credential-libsecret0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-daemon0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-email0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-gui0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-instaweb0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-subtree0:2.43.5-1.el9_4
rapidfort Oracle Linux 9git-svn0:2.43.5-1.el9_4
rapidfort Oracle Linux 9gitk0:2.43.5-1.el9_4
rapidfort Oracle Linux 9gitweb0:2.43.5-1.el9_4
rapidfort Oracle Linux 9perl-Git0:2.43.5-1.el9_4
rapidfort Oracle Linux 9perl-Git-SVN0:2.43.5-1.el9_4
rapidfort ubuntu 20.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 20.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 22.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 22.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 24.04git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
rapidfort ubuntu 24.04rf-git1:2.34.1-1ubuntu1.11, 1:2.43.0-1ubuntu7.1
Red Hatemacs-gitdüzeltme belirtilmemiş
Red Hatemacs-git-eldüzeltme belirtilmemiş
Red Hatgitdüzeltme belirtilmemiş
Red Hatgit-alldüzeltme belirtilmemiş
Red Hatgit-bzrdüzeltme belirtilmemiş
Red Hatgit-cvsdüzeltme belirtilmemiş
Red Hatgit-daemondüzeltme belirtilmemiş
Red Hatgit-emaildüzeltme belirtilmemiş
Red Hatgit-gnome-keyringdüzeltme belirtilmemiş
Red Hatgit-guidüzeltme belirtilmemiş
Red Hatgit-hgdüzeltme belirtilmemiş
Red Hatgit-instawebdüzeltme belirtilmemiş
Red Hatgit-p4düzeltme belirtilmemiş
Red Hatgit-svndüzeltme belirtilmemiş
Red Hatgitkdüzeltme belirtilmemiş
Red Hatgitwebdüzeltme belirtilmemiş
Red Hatperl-Gitdüzeltme belirtilmemiş
Red Hatperl-Git-SVNdüzeltme belirtilmemiş
Red Hatrh-git227-gitdüzeltme belirtilmemiş
Red Hatrh-git227-git-alldüzeltme belirtilmemiş
Red Hatrh-git227-git-coredüzeltme belirtilmemiş
Red Hatrh-git227-git-core-docdüzeltme belirtilmemiş
Red Hatrh-git227-git-credential-libsecretdüzeltme belirtilmemiş
Red Hatrh-git227-git-cvsdüzeltme belirtilmemiş
Red Hatrh-git227-git-daemondüzeltme belirtilmemiş
Red Hatrh-git227-git-emaildüzeltme belirtilmemiş
Red Hatrh-git227-git-guidüzeltme belirtilmemiş
Red Hatrh-git227-git-instawebdüzeltme belirtilmemiş
Red Hatrh-git227-git-p4düzeltme belirtilmemiş
Red Hatrh-git227-git-subtreedüzeltme belirtilmemiş
Red Hatrh-git227-git-svndüzeltme belirtilmemiş
Red Hatrh-git227-gitkdüzeltme belirtilmemiş
Red Hatrh-git227-gitwebdüzeltme belirtilmemiş
Red Hatrh-git227-perl-Gitdüzeltme belirtilmemiş
Red Hatrh-git227-perl-Git-SVNdüzeltme belirtilmemiş
rocky 8git2.43.5-1.el8_10
rocky 8git-all2.43.5-1.el8_10
rocky 8git-core2.43.5-1.el8_10
rocky 8git-core-doc2.43.5-1.el8_10
rocky 8git-credential-libsecret2.43.5-1.el8_10
rocky 8git-daemon2.43.5-1.el8_10
rocky 8git-email2.43.5-1.el8_10
rocky 8git-gui2.43.5-1.el8_10
rocky 8git-instaweb2.43.5-1.el8_10
rocky 8git-subtree2.43.5-1.el8_10
rocky 8git-svn2.43.5-1.el8_10
rocky 8gitk2.43.5-1.el8_10
rocky 8gitweb2.43.5-1.el8_10
rocky 8perl-Git2.43.5-1.el8_10
rocky 8perl-Git-SVN2.43.5-1.el8_10
rocky 9git2.43.5-1.el9_4
rocky 9git-all2.43.5-1.el9_4
rocky 9git-core2.43.5-1.el9_4
rocky 9git-core-doc2.43.5-1.el9_4
rocky 9git-credential-libsecret2.43.5-1.el9_4
rocky 9git-daemon2.43.5-1.el9_4
rocky 9git-email2.43.5-1.el9_4
rocky 9git-gui2.43.5-1.el9_4
rocky 9git-instaweb2.43.5-1.el9_4
rocky 9git-subtree2.43.5-1.el9_4
rocky 9git-svn2.43.5-1.el9_4
rocky 9gitk2.43.5-1.el9_4
rocky 9gitweb2.43.5-1.el9_4
rocky 9perl-Git2.43.5-1.el9_4
rocky 9perl-Git-SVN2.43.5-1.el9_4
root.io debian 11rootio-git1:2.30.2-1+deb11u3
root.io debian 12rootio-git1:2.39.5-0+deb12u1
root.io debian 13rootio-git1:2.45.1-1
root.io ubuntu 22.04rootio-git1:2.34.1-1ubuntu1.11
root.io ubuntu 24.04rootio-git1:2.43.0-1ubuntu7.1
ubuntu 18.04-ESMgit1:2.17.1-1ubuntu0.18+esm1
ubuntu 20.04git1:2.25.1-1ubuntu3.13
ubuntu 20.04-ESMgit1:2.25.1-1ubuntu3.13
ubuntu 22.04git1:2.34.1-1ubuntu1.11
ubuntu 23.10git1:2.40.1-1ubuntu1.1
ubuntu 24.04git1:2.43.0-1ubuntu7.1
wolfigit2.45.1-r0

Referanslar

35 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.