Read the docs
TI-2024-21101 Aliases CVE-2024-32002

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

Priority HIGH 74CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-434.

Summary

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.29234 98th percentileScored 2026-11-07
Fix Partial git (git): 2.43.4, 2.42.2, 2.40.2 +1Red Hat: 7 advisoriesRed Hat: 11 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gitgit= 2.45.0; = 2.44.0; 2.43.0 to before 2.43.4; 2.42.0 to before 2.42.2; = 2.41.0; 2.40.0 to before 2.40.2; before 2.39.42.43.4, 2.42.2, 2.40.2, 2.39.4Patch availableCNA
  • git VendorGit Affected = 2.45.0; = 2.44.0; 2.43.0 to before 2.43.4; 2.42.0 to before 2.42.2; = 2.41.0; 2.40.0 to before 2.40.2; before 2.39.4 Fixed in 2.43.4, 2.42.2, 2.40.2, 2.39.4 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:git:git:*:*:*:*:*:*:*:*before 2.39.4; 2.40.0 to before 2.40.2; 2.42.0 to before 2.42.2; 2.43.0 to before 2.43.4VulnerableGit
cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:*2.41.0VulnerableGit
cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:*2.44.0VulnerableGit
cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:*2.45.0VulnerableGit
  • cpe:2.3:a:git:git:*:*:*:*:*:*:*:* Versions before 2.39.4; 2.40.0 to before 2.40.2; 2.42.0 to before 2.42.2; 2.43.0 to before 2.43.4 Vulnerable ·Git
  • cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:* Versions 2.41.0 Vulnerable ·Git
  • cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:* Versions 2.44.0 Vulnerable ·Git
  • cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:* Versions 2.45.0 Vulnerable ·Git

Remediation

  • Fix · CNA git (git) Fixed in 2.43.4, 2.42.2, 2.40.2, 2.39.4

Red Hat 7 advisories

  • RHSA-2024:6610 Released 2024-09-11 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) git-2.31.1-6.el9_0, git-all-2.31.1-6.el9_0, git-core-2.31.1-6.el9_0 +12
  • RHSA-2024:6027 Released 2024-08-29 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) git-2.31.8-3.el8_6, git-all-2.31.8-3.el8_6, git-core-2.31.8-3.el8_6 +12
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) git-2.31.8-3.el8_6, git-all-2.31.8-3.el8_6, git-core-2.31.8-3.el8_6 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) git-2.31.8-3.el8_6, git-all-2.31.8-3.el8_6, git-core-2.31.8-3.el8_6 +12
  • RHSA-2024:6028 Released 2024-08-29 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-2.27.0-5.el8_4, git-all-2.27.0-5.el8_4, git-core-2.27.0-5.el8_4 +12
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) git-2.27.0-5.el8_4, git-all-2.27.0-5.el8_4, git-core-2.27.0-5.el8_4 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) git-2.27.0-5.el8_4, git-all-2.27.0-5.el8_4, git-core-2.27.0-5.el8_4 +12
Show 4 more Red Hat advisories
  • RHSA-2024:4579 Released 2024-07-16 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) git-2.39.5-1.el8_8, git-all-2.39.5-1.el8_8, git-core-2.39.5-1.el8_8 +12
  • RHSA-2024:4368 Released 2024-07-08 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) git-2.39.5-1.el9_2, git-all-2.39.5-1.el9_2, git-core-2.39.5-1.el9_2 +12
  • RHSA-2024:4083 Released 2024-06-25 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-2.43.5-1.el9_4, git-all-2.43.5-1.el9_4, git-core-2.43.5-1.el9_4 +12
  • RHSA-2024:4084 Released 2024-06-25 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.43.5-1.el8_10, git-all-2.43.5-1.el8_10, git-core-2.43.5-1.el8_10 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:4084
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:4083
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:6028
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:6027
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:6028
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:6027
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:6610
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:4579
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:4368
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:6028
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:6027
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32002

References

Patch 1

Advisory 1

Other 5

  • TI-2020-04316 malicious URLs may cause Git to present stored credentials to the wrong server CVSS 3.1CRITICAL 9.3
  • TI-2022-09232 Command injection in git CVSS 3.1CRITICAL 9.8
  • TI-2008-05233 The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2008-05232 The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2008-03393 Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in… CVSS 2.0HIGH 7.5
  • TI-2006-00463 Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to… CVSS 2.0HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences