CVE-2024-32465: Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone...

Description

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

0.91%

55.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Git-Scm	Git	< 2.39.4
Git-Scm	Git	>= 2.40.0, < 2.40.2
Git-Scm	Git	>= 2.42.0, < 2.42.2
Git-Scm	Git	>= 2.43.0, < 2.43.4
Git-Scm	Git	2.41.0
Git-Scm	Git	2.44.0
Git-Scm	Git	2.45.0
Fedoraproject	Fedora	40
Debian	Debian Linux	10.0
Debian	Debian Linux	11.0

References

http://www.openwall.com/lists/oss-security/2024/05/14/2Mailing List, Third Party Advisory
https://git-scm.com/docs/git#_securityTechnical Description
https://git-scm.com/docs/git-cloneTechnical Description
https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7Patch
https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/14/2Mailing List, Third Party Advisory
https://git-scm.com/docs/git#_securityTechnical Description
https://git-scm.com/docs/git-cloneTechnical Description
https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7Patch
https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00009.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/Mailing List, Third Party Advisory

Timeline

Published: May 14, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-32465?

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

How severe is CVE-2024-32465?

CVE-2024-32465 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.91% probability of exploitation in the next 30 days.

How do I fix CVE-2024-32465?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.