CVE-2024-32465

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with git clone --no-local to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a .zip file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32465.json"
}

References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type: GIT
Repo: https://github.com/git-for-windows/git
Events: Fixed

2868283f22fa5468d7bcf2abc47d981e1332d4ff

Introduced

218f45cba5f7a2a2e7e772b3d7672112d8eca1fd

Fixed

8e7356d297c1d56ea58dbd5fd5a44931f23e3564

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32465.json"

Git / github.com/git/git

Affected ranges

Type: GIT
Repo: https://github.com/git/git
Events: Introduced

564d0252ca632e0264ed670534a51d18a689ef5d

Fixed

1f2e64e22dee75db96b92d526d14003ba59a154e

Fixed

47b6d90e91835082010da926f6a844d4441c57a6

Fixed

7b70e9efb18c2cc3f219af399bd384c5801ba1d7

Introduced

73876f4861cd3d187a4682290ab75c9dccadbc56

Fixed

b9b439e0e3a543ddb920e4cf8d3c9d53f730111f

Introduced

43c8a30d150ecede9709c1f2527c8fba92c65f40

Fixed

babb4e5d7107ba730beff8d224e4bcf065533e0b

Affected versions

v2.*

v2.39.4

v2.40.2

v2.41.1

v2.42.2

v2.43.0

v2.43.1

v2.43.2

v2.43.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32465.json"

vanir_signatures

[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
        "digest": {
            "line_hashes": [
                "24895935137609152026691401767323182768",
                "213705167430808558393702215500403454518",
                "246074616750092741247299495563946189079",
                "142284556392129674621285378607207771749"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-32465-1f9d9764",
        "deprecated": false,
        "target": {
            "file": "builtin/upload-pack.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
        "digest": {
            "line_hashes": [
                "20137929257677507433737657050881151365",
                "34757250967373426474970794593731624982",
                "119798621434729037102225573451019537530"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-32465-3d062b33",
        "deprecated": false,
        "target": {
            "file": "promisor-remote.c"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
        "digest": {
            "function_hash": "338693055186718475485492629440546523803",
            "length": 1133.0
        },
        "id": "CVE-2024-32465-93435a6c",
        "deprecated": false,
        "target": {
            "file": "promisor-remote.c",
            "function": "fetch_objects"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7",
        "digest": {
            "function_hash": "197075911813756590670167138436387342893",
            "length": 1342.0
        },
        "id": "CVE-2024-32465-b70d6cb7",
        "deprecated": false,
        "target": {
            "file": "builtin/upload-pack.c",
            "function": "cmd_upload_pack"
        }
    }
]