CVE-2024-32002

EUVD-2024-29843

14.05.2024, 19:15

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Path Traversal

Link Following

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9 CRITICAL	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 97%

Affected Products (NVD)

Vendor	Product	Version
git	git	𝑥 < 2.39.4
git	git	2.40.0 ≤ 𝑥 < 2.40.2
git	git	2.42.0 ≤ 𝑥 < 2.42.2
git	git	2.43.0 ≤ 𝑥 < 2.43.4
git	git	2.41.0
git	git	2.44.0
git	git	2.45.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
git	git	2.43 ≤ 𝑥 < 2.43.4	ADP
git	git	2.42.0 ≤ 𝑥 < 2.42.2	ADP
git	git	2.40.0 ≤ 𝑥 < 2.40.2	ADP
git	git	𝑥 < 2.39.4	ADP

Debian Releases

Debian Product

Codename

git

bookworm	1:2.39.5-0+deb12u2 fixed
bookworm (security)	1:2.39.5-0+deb12u2 fixed
bullseye	vulnerable
bullseye (security)	1:2.30.2-1+deb11u5 fixed
forky	1:2.51.0-1 fixed
sid	1:2.51.0-1 fixed
trixie	1:2.47.3-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

git

bionic	Fixed 1:2.17.1-1ubuntu0.18+esm1 released
focal	Fixed 1:2.25.1-1ubuntu3.13 released
jammy	Fixed 1:2.34.1-1ubuntu1.11 released
mantic	Fixed 1:2.40.1-1ubuntu1.1 released
noble	Fixed 1:2.43.0-1ubuntu7.1 released
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

git

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-arch

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-core

suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed

git-cvs

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-daemon

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-doc

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-email

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-gui

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-svn

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

git-web

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

gitk

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 12 SP3	2.26.2-27.78.1 fixed
suse enterprise server 12 SP5	2.26.2-27.78.1 fixed
suse enterprise server 15 SP2	2.26.2-150000.56.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

perl-Git

suse enterprise desktop 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise desktop 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise sap 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise sap 15 SP7	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP3	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP4	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP5	2.35.3-150300.10.39.1 fixed
suse enterprise server 15 SP6	2.43.0-150600.3.3.1 fixed
suse enterprise server 15 SP7	2.43.0-150600.3.3.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

git

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-all

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-core

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-core-doc

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-credential-libsecret

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-daemon

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-email

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-gui

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-instaweb

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-subtree

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

git-svn

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

gitk

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

gitweb

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

perl-Git

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

perl-Git-SVN

RHEL 8	0:2.43.5-1.el8_10 fixed
RHEL 8.4 AUS	0:2.27.0-5.el8_4 fixed
RHEL 8.4 E4S	0:2.27.0-5.el8_4 fixed
RHEL 8.4 TUS	0:2.27.0-5.el8_4 fixed
RHEL 8.6 AUS	0:2.31.8-3.el8_6 fixed
RHEL 8.6 E4S	0:2.31.8-3.el8_6 fixed
RHEL 8.6 TUS	0:2.31.8-3.el8_6 fixed
RHEL 8.8 AUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 E4S	0:2.39.5-1.el8_8 fixed
RHEL 8.8 EUS	0:2.39.5-1.el8_8 fixed
RHEL 8.8 TUS	0:2.39.5-1.el8_8 fixed
RHEL 9	0:2.43.5-1.el9_4 fixed

Amazon Linux Releases

Amazon Package

Release

emacs-git

Amazon Linux 1

0:2.38.4-1.81.amzn1

fixed

emacs-git-el

Amazon Linux 1

0:2.38.4-1.81.amzn1

fixed

git

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-all

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-bzr

Amazon Linux 1

0:2.38.4-1.81.amzn1

fixed

git-core

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-core-debuginfo

Amazon Linux 2023

0:2.40.1-1.amzn2023.0.3

fixed

git-core-doc

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-credential-libsecret

Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-credential-libsecret-debuginfo

Amazon Linux 2023

0:2.40.1-1.amzn2023.0.3

fixed

git-cvs

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-daemon

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-daemon-debuginfo

Amazon Linux 2023

0:2.40.1-1.amzn2023.0.3

fixed

git-debuginfo

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-debugsource

Amazon Linux 2023

0:2.40.1-1.amzn2023.0.3

fixed

git-email

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-gui

Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-hg

Amazon Linux 1

0:2.38.4-1.81.amzn1

fixed

git-instaweb

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-p4

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-subtree

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

git-svn

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

gitk

Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

gitweb

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

perl-Git

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

perl-Git-SVN

Amazon Linux 1	0:2.38.4-1.81.amzn1 fixed
Amazon Linux 2	0:2.40.1-1.amzn2.0.3 fixed
Amazon Linux 2023	0:2.40.1-1.amzn2023.0.3 fixed

Azure Linux Releases

Azure Package

Release

git

Azure Linux 3.0	0:2.45.2-1.azl3 fixed
CBL-Mariner 2.0	0:2.39.4-1.cm2 fixed

Common Weakness Enumeration

References

http://www.openwall.com/lists/oss-security/2024/05/14/2

https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt

https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks

https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d

https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv

https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/

http://www.openwall.com/lists/oss-security/2024/05/14/2

https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt

https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks

https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d

https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv

https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html

https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/