This advisory covers five security vulnerabilities in Git distributed with Red Hat Enterprise Linux 8, notably CVE-2024-32002 (recursive clones RCE), CVE-2024-32004 (RCE while cloning local repositories), CVE-2024-32465 (additional local RCE), CVE-2024-32020 (insecure hardlinks), and CVE-2024-32021 (symlink bypass). These vulnerabilities allow for potential remote or local code execution and insecure file operations during Git cloning or repository handling. Red Hat has issued updated Git packages (version 2.43.5-1.el8_10) to fix these issues. The advisory is classified as important, and the update is available for multiple architectures including x86_64, s390x, ppc64le, and aarch64. No known exploits in the wild have been reported at the time of this advisory.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code locally or remotely during Git operations such as cloning repositories, potentially leading to system compromise. The insecure hardlinks and symlink bypass issues could allow unauthorized file manipulation. The overall impact is high due to the possibility of remote code execution and local privilege escalation.

Red Hat has released an updated Git package (version 2.43.5-1.el8_10) that addresses all listed vulnerabilities. Users should apply this official security update promptly to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.