p PatchFirst

CVE-2024-32002

CVE-2024-32002 · Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

CVSS 9.1 · Crítica · EPSS 29,2% · Código de explotación público · Corrección disponible

Publicación
Actualización

Pila tecnológica: system

Productos y versiones afectados

  • git

    Versiones
    • = 2.45.0: Afectada
    • = 2.44.0: Afectada
    • >= 2.43.0, < 2.43.4: Afectada
    • >= 2.42.0, < 2.42.2: Afectada
    • = 2.41.0: Afectada
    • >= 2.40.0, < 2.40.2: Afectada
    • < 2.39.4: Afectada

    Sin corrección publicada

  • git Debian:12

    Versiones
    • 1:2.39.2+next.20230215-1
    • 1:2.39.2-1.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.39.5-0+deb12u1

    Actualiza a 1:2.39.5-0+deb12u1

  • git Debian:13

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.45.1-1

    Actualiza a 1:2.45.1-1

  • git Debian:14

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.45.1-1

    Actualiza a 1:2.45.1-1

  • git Ubuntu:Pro:18.04:LTS

    Versiones
    • 1:2.14.1-1ubuntu4
    • 1:2.15.1-1ubuntu2
    • 1:2.17.0-1ubuntu1
    • 1:2.17.1-1ubuntu0.1
    • 1:2.17.1-1ubuntu0.3
    • 1:2.17.1-1ubuntu0.4
    • 1:2.17.1-1ubuntu0.5
    • 1:2.17.1-1ubuntu0.6
    • 1:2.17.1-1ubuntu0.7
    • 1:2.17.1-1ubuntu0.8
    • 1:2.17.1-1ubuntu0.9
    • 1:2.17.1-1ubuntu0.10
    • 1:2.17.1-1ubuntu0.11
    • 1:2.17.1-1ubuntu0.12
    • 1:2.17.1-1ubuntu0.13
    • 1:2.17.1-1ubuntu0.14
    • 1:2.17.1-1ubuntu0.15
    • 1:2.17.1-1ubuntu0.16
    • 1:2.17.1-1ubuntu0.17
    • 1:2.17.1-1ubuntu0.18
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.17.1-1ubuntu0.18+esm1

    Actualiza a 1:2.17.1-1ubuntu0.18+esm1

  • git Ubuntu:20.04:LTS

    Versiones
    • 1:2.20.1-2ubuntu1
    • 1:2.24.0-1ubuntu1
    • 1:2.24.0-1ubuntu2
    • 1:2.25.0-1ubuntu1
    • 1:2.25.1-1ubuntu1
    • 1:2.25.1-1ubuntu2
    • 1:2.25.1-1ubuntu3
    • 1:2.25.1-1ubuntu3.1
    • 1:2.25.1-1ubuntu3.2
    • 1:2.25.1-1ubuntu3.3
    • 1:2.25.1-1ubuntu3.4
    • 1:2.25.1-1ubuntu3.5
    • 1:2.25.1-1ubuntu3.6
    • 1:2.25.1-1ubuntu3.7
    • 1:2.25.1-1ubuntu3.8
    • 1:2.25.1-1ubuntu3.10
    • 1:2.25.1-1ubuntu3.11
    • 1:2.25.1-1ubuntu3.12
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.25.1-1ubuntu3.13

    Actualiza a 1:2.25.1-1ubuntu3.13

  • git Ubuntu:22.04:LTS

    Versiones
    • 1:2.32.0-1ubuntu1
    • 1:2.33.1-1ubuntu1
    • 1:2.34.1-1ubuntu1
    • 1:2.34.1-1ubuntu1.1
    • 1:2.34.1-1ubuntu1.2
    • 1:2.34.1-1ubuntu1.4
    • 1:2.34.1-1ubuntu1.5
    • 1:2.34.1-1ubuntu1.6
    • 1:2.34.1-1ubuntu1.8
    • 1:2.34.1-1ubuntu1.9
    • 1:2.34.1-1ubuntu1.10
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.34.1-1ubuntu1.11

    Actualiza a 1:2.34.1-1ubuntu1.11

  • git Ubuntu:24.04:LTS

    Versiones
    • 1:2.40.1-1ubuntu1
    • 1:2.43.0-1ubuntu1
    • 1:2.43.0-1ubuntu5
    • 1:2.43.0-1ubuntu6
    • 1:2.43.0-1ubuntu7
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:2.43.0-1ubuntu7.1

    Actualiza a 1:2.43.0-1ubuntu7.1

Fuentes originales

Comprueba tu servidor →