Bug 2280428 (CVE-2024-32004)

Summary: CVE-2024-32004 git: RCE while cloning local repos
Product: [Other] Security Response Reporter: Nick Tait <ntait>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aprice, bdettelb, caswilli, chazlett, dfreiber, dkuc, drow, fjansen, gmalinko, hhorak, hkataria, janstey, jburrell, jmitchel, jorton, jsamir, jsherril, jtanner, kaycoth, kshier, mpierce, musman, opohorel, orabin, pdelbell, rstepani, sidakwo, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: git 2.45.1, git 2.44.1, git 2.43.4, git 2.42.2, git 2.41.1 , git 2.40.2, git 2.39.4 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Git. This vulnerability can be exploited by an unauthenticated attacker who places a specialized repository on the target's local system. If the victim clones this repository, the attacker can execute arbitrary code.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2280429, 2280430, 2280431, 2280432, 2280433, 2280436    
Bug Blocks: 2280416    

Description Nick Tait 2024-05-14 23:27:02 UTC
An attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation.

Comment 1 Nick Tait 2024-05-14 23:27:15 UTC
Created git tracking bugs for this issue:

Affects: fedora-all [bug 2280429]

Comment 2 Nick Tait 2024-05-14 23:29:26 UTC
Created rubygem-dynect_rest tracking bugs for this issue:

Affects: epel-all [bug 2280430]


Created rubygem-rouge tracking bugs for this issue:

Affects: fedora-all [bug 2280431]


Created rubygem-stringex tracking bugs for this issue:

Affects: fedora-all [bug 2280432]


Created swiftlint tracking bugs for this issue:

Affects: fedora-all [bug 2280433]

Comment 7 errata-xmlrpc 2024-06-25 08:18:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:4084 https://access.redhat.com/errata/RHSA-2024:4084

Comment 8 errata-xmlrpc 2024-06-25 08:24:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4083 https://access.redhat.com/errata/RHSA-2024:4083

Comment 10 errata-xmlrpc 2024-07-08 11:21:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4368 https://access.redhat.com/errata/RHSA-2024:4368

Comment 11 errata-xmlrpc 2024-07-16 19:30:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:4579 https://access.redhat.com/errata/RHSA-2024:4579

Comment 12 errata-xmlrpc 2024-08-29 11:27:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:6028 https://access.redhat.com/errata/RHSA-2024:6028

Comment 13 errata-xmlrpc 2024-08-29 11:33:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:6027 https://access.redhat.com/errata/RHSA-2024:6027

Comment 14 errata-xmlrpc 2024-09-11 18:07:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:6610 https://access.redhat.com/errata/RHSA-2024:6610

Comment 15 errata-xmlrpc 2024-10-07 01:10:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:7701 https://access.redhat.com/errata/RHSA-2024:7701