CoreCVE
Back

HIGH

Git vulnerable to Remote Code Execution while cloning special-crafted local repositories

Published May 14, 2024

Description

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.

Affected products

Remediation

Red Hat statement

This vulnerability, while significant, does not reach Critical severity due to its reliance on local repository manipulation. While it allows attackers to execute arbitrary code during cloning operations, its impact is constrained by the necessity for access to the target's local environment. Critical severity typically involves vulnerabilities that can be exploited remotely or without user interaction. Nonetheless, this issue remains Important as it can lead to unauthorized code execution, potentially compromising the integrity and security of affected systems. Fuse 7 Karaf uses JGit to manage patches. It's heavily protected by file permissions and RBAC. Unless an attacker have write permissions to Fuse internal git repositories, this vulnerability is not exploitable.

Red Hat mitigation

Exercise caution when cloning repositories from untrusted sources.

Metrics

Weaknesses (1)

CWE-114

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 14, 2024
Updated Nov 4, 2025
Reserved Apr 8, 2024
Link CVE-2024-32004
CISA Vulnrichment
Updated May 15, 2024
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2024-32004
Red Hat
Severity Important
Public date May 14, 2024
Links CVE-2024-32004 - Bugzilla