CVE-2024-32004

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-32004
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/05/14/2 Mailing List Third Party Advisory
https://git-scm.com/docs/git-clone Technical Description
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8 Patch
https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html Mailing List Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/14/2 Mailing List Third Party Advisory
https://git-scm.com/docs/git-clone Technical Description
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8 Patch
https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html Mailing List Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

06 Jan 2026, 17:09

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/05/14/2 - () http://www.openwall.com/lists/oss-security/2024/05/14/2 - Mailing List, Third Party Advisory
References () https://git-scm.com/docs/git-clone - () https://git-scm.com/docs/git-clone - Technical Description
References () https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8 - () https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8 - Patch
References () https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389 - () https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389 - Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html - Mailing List, Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ - Mailing List, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html - () https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html - Mailing List, Vendor Advisory
First Time Git-scm
Fedoraproject fedora
Git-scm git
Fedoraproject
Debian debian Linux
Debian
CPE cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*
cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

04 Nov 2025, 17:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html -

21 Nov 2024, 09:14

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/05/14/2 - () http://www.openwall.com/lists/oss-security/2024/05/14/2 -
References () https://git-scm.com/docs/git-clone - () https://git-scm.com/docs/git-clone -
References () https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8 - () https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8 -
References () https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389 - () https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389 -
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ -

26 Jun 2024, 10:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html -

10 Jun 2024, 19:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/05/14/2 -

10 Jun 2024, 18:15

Type Values Removed Values Added
Summary
  • (es) Git es un sistema de control de revisiones. Antes de las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4, un atacante puede preparar un repositorio local de tal manera que, cuando se clone, ejecute código arbitrario durante la operación. El problema se solucionó en las versiones 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 y 2.39.4. Como workaround, evite clonar repositorios de fuentes que no sean de confianza.
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/ -

14 May 2024, 19:17

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 19:15

Updated : 2026-01-06 17:09

NVD link : CVE-2024-32004

Mitre link : CVE-2024-32004

CVE.ORG link : CVE-2024-32004

JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • fedora

git-scm

  • git
CWE
CWE-114

Process Control