Threats affecting pkg:github/git/git

Multiple vulnerabilities have been identified in Git, a distributed version control system. These issues affect Git versions prior to 2.56.1. A fixed version, 2.56.1, has been released to address these vulnerabilities.

CVE-2024-32465 is a path traversal vulnerability in Git that affects certain versions prior to patched releases. It allows bypassing protections when working with untrusted repositories, especially when repositories are obtained as archives like .zip files. This can lead to execution of malicious hooks within the repository context. The issue has been fixed in multiple Git versions starting from 2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, and 2.44.1. Users are advised to avoid using Git on repositories obtained from untrusted archive sources or to upgrade to patched versions.

A vulnerability in Git prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 allows an attacker to create hardlinks to arbitrary user-readable files on the same filesystem when cloning a local repository containing symlinks. This occurs due to a race condition in the checks against symbolic links during the hard link operation in local cloning optimizations.

CVE-2024-32004 is a high-severity vulnerability in Git prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows an attacker to craft a local repository that, when cloned, executes arbitrary code during the cloning process. This issue has been patched in the specified fixed versions. Users are advised to avoid cloning repositories from untrusted sources as a temporary mitigation.

CVE-2024-32002 is a critical path traversal vulnerability in Git affecting versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows crafted repositories with submodules to write files into the .git/ directory instead of the submodule worktree, enabling execution of malicious hooks during cloning without user inspection. Disabling symbolic link support in Git mitigates the attack. The issue has been patched in the specified fixed versions.