CVE-2024-32002

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

• CWE-22
• CWE-434
• CWE-59

• http://www.openwall.com/lists/oss-security/2024/05/14/2
• https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgtNot Applicable
• https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinksNot Applicable
• https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991dPatch
• https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgvThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/
• http://www.openwall.com/lists/oss-security/2024/05/14/2
• https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgtNot Applicable
• https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinksNot Applicable
• https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991dPatch
• https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgvThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31997XWiki Platform is a generic wiki platform. Prior to versions…8.8
• CVE-2024-31998Combodo iTop is a simple, web based IT Service Management to…8.8
• CVE-2024-31999@festify/secure-session creates a secure stateless cookie se…7.4
• CVE-2024-3200The wpForo Forum plugin for WordPress is vulnerable to SQL I…6.5
• CVE-2024-32000matrix-appservice-irc is a Node.js IRC bridge for the Matrix…4.3
• CVE-2024-32001SpiceDB is a graph database purpose-built for storing and ev…4.3
• CVE-2024-32003wn-dusk-plugin (Dusk plugin) is a plugin which integrates La…8.8
• CVE-2024-32004Git is a revision control system. Prior to versions 2.45.1, …7.8
• CVE-2024-32005NiceGUI is an easy-to-use, Python-based UI framework. A loca…8.2
• CVE-2024-32006A vulnerability has been identified in SINEMA Remote Connect…6.5
• CVE-2024-32007An improper input validation of the p2c parameter in the Apa…7.5
• CVE-2024-32008A vulnerability has been identified in Spectrum Power 4 (All…8.5