CVE-2024-32004

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-114

Affected software

Vendor	Product	Versions
git	git	= 2.45.0; = 2.44.0; >= 2.43.0, < 2.43.4; >= 2.42.0, < 2.42.2; = 2.41.0; >= 2.40.0, < 2.40.2; < 2.39.4
git	git	2.45.0
git	git	2.44.0
git	git	>= 2.43.0, < 2.43.4
git	git	>= 2.42.0, < 2.42.2
git	git	2.41.0
git	git	>= 2.40.0, < 2.40.2
git	git	< 2.39.4

References

http://www.openwall.com/lists/oss-security/2024/05/14/2Mailing List, Third Party Advisory
https://git-scm.com/docs/git-cloneTechnical Description
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8Patch
https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.htmlMailing List, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/14/2Mailing List, Third Party Advisory
https://git-scm.com/docs/git-cloneTechnical Description
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8Patch
https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.htmlMailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00009.htmlMailing List, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/Mailing List, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-320058.2NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting reso CVE-2024-320066.5A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the CVE-2024-320077.5An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a CVE-2024-320087.8A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a lo CVE-2024-320097.8A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a lo CVE-2024-32016.4The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp_link' shortcode in all vers CVE-2024-320107.8A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extr CVE-2024-320118.8A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run CVE-2024-320144.7A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alte CVE-2024-320179.0RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontr CVE-2024-320189.0RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontr CVE-2024-320198.8Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent all