CVE-2024-32004

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32004
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32004.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32004
Aliases
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (2)
CLEANSTART (1)
CLSA (11)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (8)
RLSA (2)
SUSE (6)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (6)
Published
2024-05-14T18:46:32Z
Modified
2026-10-21T02:49:46Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
Details

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-114"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32004.json"
}
References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type
GIT
Repo
https://github.com/git-for-windows/git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2868283f22fa5468d7bcf2abc47d981e1332d4ff
Introduced
4b968f3ea3b32a7bc50846bab49f3f381841d297
Fixed
8e7356d297c1d56ea58dbd5fd5a44931f23e3564
Introduced
ad0bbfffa543db6979717be96df630d3e5741331
Last Affected
b5d0511969ccd9ab86395c37e5a7619d8b4e7c32
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.39.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.43.0"
                },
                {
                    "fixed":  "2.43.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.44.0"
                },
                {
                    "last_affected":  "2.44.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.45.0"
                },
                {
                    "last_affected":  "2.45.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}
Type
GIT
Repo
https://github.com/git/git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
47b6d90e91835082010da926f6a844d4441c57a6
Introduced
73876f4861cd3d187a4682290ab75c9dccadbc56
Fixed
b9b439e0e3a543ddb920e4cf8d3c9d53f730111f
Introduced
43c8a30d150ecede9709c1f2527c8fba92c65f40
Fixed
babb4e5d7107ba730beff8d224e4bcf065533e0b
Introduced
564d0252ca632e0264ed670534a51d18a689ef5d
Fixed
1f2e64e22dee75db96b92d526d14003ba59a154e
Introduced
fe86abd7511a9a6862d5706c6fa1d9b57a63ba09
Fixed
f4aa8c8bb11dae6e769cd930565173808cbb69c8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.39.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.40.0"
                },
                {
                    "fixed":  "2.40.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.42.0"
                },
                {
                    "fixed":  "2.42.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.43.0"
                },
                {
                    "fixed":  "2.43.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.41.0"
                },
                {
                    "last_affected":  "2.41.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.44.0"
                },
                {
                    "last_affected":  "2.44.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.45.0"
                },
                {
                    "last_affected":  "2.45.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "f4aa8c8bb11dae6e769cd930565173808cbb69c8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.41.0
2.44.0
2.45.0
= 2.*
= 2.41.0
= 2.44.0
= 2.45.0
v0.*
v0.99
v0.99.1
v0.99.2
v0.99.3
v0.99.4
v0.99.5
v0.99.6
v0.99.7
v0.99.8
v0.99.8a
v0.99.8b
v0.99.8c
v0.99.8d
v0.99.8e
v0.99.8f
v0.99.8g
v0.99.9a
v0.99.9b
v0.99.9c
v0.99.9d
v0.99.9e
v0.99.9f
v0.99.9g
v0.99.9h
v0.99.9i
v0.99.9j
v0.99.9k
v0.99.9l
v0.99.9m
v0.99.9n
v1.*
v1.0.0
v1.0rc1
v1.0rc2
v1.0rc3
v1.0rc4
v1.0rc5
v1.0rc6
v1.1.0
v1.2.0
v1.3.0-rc1
v1.4.1
v1.4.1-rc1
v1.4.1-rc2
v1.4.2
v1.4.2-rc1
v1.4.2-rc2
v1.4.2-rc3
v1.4.2-rc4
v1.4.3
v1.4.3-rc1
v1.4.3-rc2
v1.4.3-rc3
v1.4.4
v1.4.4-rc1
v1.4.4-rc2
v1.4.4.1
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.5.1
v1.5.1-rc1
v1.5.1-rc2
v1.5.1-rc3
v1.5.2
v1.5.2-rc0
v1.5.2-rc1
v1.5.2-rc2
v1.5.2-rc3
v1.5.3
v1.5.3-rc0
v1.5.3-rc1
v1.5.3-rc2
v1.5.3-rc3
v1.5.3-rc4
v1.5.3-rc5
v1.5.3-rc6
v1.5.3-rc7
v1.5.3.1
v1.5.4
v1.5.4-rc0
v1.5.4-rc1
v1.5.4-rc2
v1.5.4-rc3
v1.5.4-rc4
v1.5.4-rc5
v1.5.5
v1.5.5-rc0
v1.5.5-rc1
v1.5.5-rc2
v1.5.5-rc3
v1.5.6
v1.5.6-rc0
v1.5.6-rc1
v1.5.6-rc2
v1.5.6-rc3
v1.6.0
v1.6.0-rc0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.6.1
v1.6.1-rc1
v1.6.1-rc2
v1.6.1-rc3
v1.6.1-rc4
v1.6.2
v1.6.2-rc0
v1.6.2-rc1
v1.6.2-rc2
v1.6.3
v1.6.3-rc0
v1.6.3-rc1
v1.6.3-rc2
v1.6.3-rc3
v1.6.3-rc4
v1.6.4
v1.6.4-rc0
v1.6.4-rc1
v1.6.4-rc2
v1.6.4-rc3
v1.6.5
v1.6.5-rc0
v1.6.5-rc1
v1.6.5-rc2
v1.6.5-rc3
v1.6.6
v1.6.6-rc0
v1.6.6-rc1
v1.6.6-rc2
v1.6.6-rc3
v1.6.6-rc4
v1.7.0
v1.7.0-rc0
v1.7.0-rc1
v1.7.0-rc2
v1.7.1
v1.7.1-rc0
v1.7.1-rc1
v1.7.1-rc2
v1.7.10
v1.7.10-rc0
v1.7.10-rc1
v1.7.10-rc2
v1.7.10-rc3
v1.7.10-rc4
v1.7.11
v1.7.11-rc0
v1.7.11-rc1
v1.7.11-rc2
v1.7.11-rc3
v1.7.12
v1.7.12-rc0
v1.7.12-rc1
v1.7.12-rc2
v1.7.12-rc3
v1.7.2
v1.7.2-rc0
v1.7.2-rc1
v1.7.2-rc2
v1.7.2-rc3
v1.7.3
v1.7.3-rc0
v1.7.3-rc1
v1.7.3-rc2
v1.7.3.1
v1.7.4
v1.7.4-rc0
v1.7.4-rc1
v1.7.4-rc2
v1.7.4-rc3
v1.7.5
v1.7.5-rc0
v1.7.5-rc1
v1.7.5-rc2
v1.7.5-rc3
v1.7.6
v1.7.6-rc0
v1.7.6-rc1
v1.7.6-rc2
v1.7.6-rc3
v1.7.7
v1.7.7-rc0
v1.7.7-rc1
v1.7.7-rc2
v1.7.7-rc3
v1.7.8
v1.7.8-rc0
v1.7.8-rc1
v1.7.8-rc2
v1.7.8-rc3
v1.7.8-rc4
v1.7.9
v1.7.9-rc0
v1.7.9-rc1
v1.7.9-rc2
v1.8.0
v1.8.0-rc0
v1.8.0-rc1
v1.8.0-rc2
v1.8.0-rc3
v1.8.1
v1.8.1-rc0
v1.8.1-rc1
v1.8.1-rc2
v1.8.1-rc3
v1.8.2
v1.8.2-rc0
v1.8.2-rc1
v1.8.2-rc2
v1.8.2-rc3
v1.8.3
v1.8.3-rc0
v1.8.3-rc1
v1.8.3-rc2
v1.8.3-rc3
v1.8.4
v1.8.4-rc0
v1.8.4-rc1
v1.8.4-rc2
v1.8.4-rc3
v1.8.4-rc4
v1.8.5
v1.8.5-rc0
v1.8.5-rc1
v1.8.5-rc2
v1.8.5-rc3
v1.9-rc0
v1.9-rc1
v1.9-rc2
v1.9.0
v1.9.0-rc3
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.0.0-rc4
v2.1.0
v2.1.0-rc0
v2.1.0-rc1
v2.1.0-rc2
v2.10.0
v2.10.0-rc0
v2.10.0-rc1
v2.10.0-rc2
v2.11.0
v2.11.0-rc0
v2.11.0-rc1
v2.11.0-rc2
v2.11.0-rc3
v2.12.0
v2.12.0-rc0
v2.12.0-rc1
v2.12.0-rc2
v2.13.0
v2.13.0-rc0
v2.13.0-rc1
v2.13.0-rc2
v2.14.0
v2.14.0-rc0
v2.14.0-rc1
v2.15.0
v2.15.0-rc0
v2.15.0-rc1
v2.15.0-rc2
v2.16.0
v2.16.0-rc0
v2.16.0-rc1
v2.16.0-rc2
v2.17.0
v2.17.0-rc0
v2.17.0-rc1
v2.17.0-rc2
v2.18.0
v2.18.0-rc0
v2.18.0-rc1
v2.18.0-rc2
v2.19.0
v2.19.0-rc0
v2.19.0-rc1
v2.19.0-rc2
v2.2.0
v2.2.0-rc0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.20.0
v2.20.0-rc0
v2.20.0-rc1
v2.20.0-rc2
v2.21.0
v2.21.0-rc0
v2.21.0-rc1
v2.21.0-rc2
v2.22.0
v2.22.0-rc0
v2.22.0-rc1
v2.22.0-rc2
v2.22.0-rc3
v2.23.0
v2.23.0-rc0
v2.23.0-rc1
v2.23.0-rc2
v2.24.0
v2.24.0-rc0
v2.24.0-rc1
v2.24.0-rc2
v2.25.0
v2.25.0-rc0
v2.25.0-rc1
v2.25.0-rc2
v2.26.0
v2.26.0-rc0
v2.26.0-rc1
v2.26.0-rc2
v2.27.0
v2.27.0-rc0
v2.27.0-rc1
v2.27.0-rc2
v2.28.0
v2.28.0-rc0
v2.28.0-rc1
v2.28.0-rc2
v2.29.0
v2.29.0-rc0
v2.29.0-rc1
v2.29.0-rc2
v2.3.0
v2.3.0-rc0
v2.3.0-rc1
v2.3.0-rc2
v2.30.0
v2.30.0-rc0
v2.30.0-rc1
v2.30.0-rc2
v2.31.0
v2.31.0-rc0
v2.31.0-rc1
v2.31.0-rc2
v2.32.0
v2.32.0-rc0
v2.32.0-rc1
v2.32.0-rc2
v2.32.0-rc3
v2.33.0
v2.33.0-rc0
v2.33.0-rc1
v2.33.0-rc2
v2.34.0
v2.34.0-rc0
v2.34.0-rc1
v2.34.0-rc2
v2.35.0
v2.35.0-rc0
v2.35.0-rc1
v2.35.0-rc2
v2.36.0
v2.36.0-rc0
v2.36.0-rc1
v2.36.0-rc2
v2.37.0
v2.37.0-rc0
v2.37.0-rc1
v2.37.0-rc2
v2.38.0
v2.38.0-rc0
v2.38.0-rc1
v2.38.0-rc2
v2.39.0
v2.39.0-rc0
v2.39.0-rc1
v2.39.0-rc2
v2.39.1
v2.39.2
v2.39.2.windows.1
v2.39.3
v2.39.3.windows.1
v2.4.0
v2.4.0-rc0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.40.0
v2.40.1
v2.41.0-rc0
v2.42.0
v2.42.1
v2.43.0
v2.43.0.windows.1
v2.43.1
v2.43.2
v2.43.3
v2.45.0.windows.1
v2.5.0
v2.5.0-rc0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.6.0
v2.6.0-rc0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0
v2.7.0-rc0
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.8.0
v2.8.0-rc0
v2.8.0-rc1
v2.8.0-rc2
v2.8.0-rc3
v2.8.0-rc4
v2.9.0
v2.9.0-rc0
v2.9.0-rc1
v2.9.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32004.json"