CVE-2024-32004

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.

Database specific

{
    "cwe_ids": [
        "CWE-114"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32004.json"
}

References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type: GIT
Repo: https://github.com/git-for-windows/git
Events: Introduced

4b968f3ea3b32a7bc50846bab49f3f381841d297

Fixed

8e7356d297c1d56ea58dbd5fd5a44931f23e3564

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32004.json"

Git / github.com/git/git

Affected ranges

Type: GIT
Repo: https://github.com/git/git
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

f4aa8c8bb11dae6e769cd930565173808cbb69c8

Introduced

43c8a30d150ecede9709c1f2527c8fba92c65f40

Fixed

babb4e5d7107ba730beff8d224e4bcf065533e0b

Introduced

564d0252ca632e0264ed670534a51d18a689ef5d

Fixed

1f2e64e22dee75db96b92d526d14003ba59a154e

Introduced

73876f4861cd3d187a4682290ab75c9dccadbc56

Fixed

b9b439e0e3a543ddb920e4cf8d3c9d53f730111f

Affected versions

v2.*

v2.42.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32004.json"

vanir_signatures

[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8",
        "digest": {
            "line_hashes": [
                "45294003144689119548277046678289316083",
                "309352054631505652906559086720521916691",
                "227127197232322950683898198590264096921",
                "193314351807589747373269628427310562660",
                "177745855262106223516038815373878749657",
                "300642084120798625785048215664597812800",
                "133722532631573321917649465671677779790",
                "210790909159161503000163879877459222109"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-32004-3ab715ca",
        "deprecated": false,
        "target": {
            "file": "path.c"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8",
        "digest": {
            "function_hash": "65755541231955128684927330193945321426",
            "length": 1436.0
        },
        "id": "CVE-2024-32004-436d3789",
        "deprecated": false,
        "target": {
            "file": "path.c",
            "function": "enter_repo"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8",
        "digest": {
            "line_hashes": [
                "52887605817421439801183684811235498754",
                "33419222072235022558223135471097715196",
                "96187727428552915029369741612525680600"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-32004-4e1789c9",
        "deprecated": false,
        "target": {
            "file": "cache.h"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8",
        "digest": {
            "line_hashes": [
                "263380987938213441223031154487962457493",
                "27029750263920257402586502723201047642",
                "313249096040047857051149013071639811598"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-32004-c303070a",
        "deprecated": false,
        "target": {
            "file": "setup.c"
        }
    }
]