PT-2024-3567 · Git+11 · Git+11
Filip-Hejsek
·
Published
2024-05-14
·
Updated
2026-05-22
·
CVE-2024-32002
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Git versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4
Description
The issue allows an attacker to execute arbitrary code when cloning repositories with submodules. This is possible because Git can be fooled into writing files not into the submodule's worktree but into a
.git/ directory, enabling the execution of a hook during the clone operation without the user's opportunity to inspect the code. If symbolic link support is disabled in Git, the attack won't work. It is recommended to avoid cloning repositories from untrusted sources.Recommendations
To resolve the issue for each affected version, update Git to version 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, or 2.39.4, or later.
As a temporary workaround, consider disabling symbolic link support in Git via
git config --global core.symlinks false.
For Git for Windows users, update Git by running "git update-git-for-windows".Exploit
Fix
RCE
Link Following
Path traversal
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Git
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu