{
  "threat_severity" : "Important",
  "public_date" : "2024-05-14T00:00:00Z",
  "bugzilla" : {
    "description" : "git: RCE while cloning local repos",
    "id" : "2280428",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2280428"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-114",
  "details" : [ "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.", "A vulnerability was found in Git. This vulnerability can be exploited by an unauthenticated attacker who places a specialized repository on the target's local system. If the victim clones this repository, the attacker can execute arbitrary code." ],
  "statement" : "This vulnerability, while significant, does not reach Critical severity due to its reliance on local repository manipulation. While it allows attackers to execute arbitrary code during cloning operations, its impact is constrained by the necessity for access to the target's local environment. Critical severity typically involves vulnerabilities that can be exploited remotely or without user interaction. Nonetheless, this issue remains Important as it can lead to unauthorized code execution, potentially compromising the integrity and security of affected systems.\nFuse 7 Karaf uses JGit to manage patches. It's heavily protected by file permissions and RBAC. Unless an attacker have write permissions to Fuse internal git repositories, this vulnerability is not exploitable.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-06-25T00:00:00Z",
    "advisory" : "RHSA-2024:4084",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "git-0:2.43.5-1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7701",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "git-0:2.18.4-5.el8_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2024-08-29T00:00:00Z",
    "advisory" : "RHSA-2024:6028",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "git-0:2.27.0-5.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
    "release_date" : "2024-08-29T00:00:00Z",
    "advisory" : "RHSA-2024:6028",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.4",
    "package" : "git-0:2.27.0-5.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
    "release_date" : "2024-08-29T00:00:00Z",
    "advisory" : "RHSA-2024:6028",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.4",
    "package" : "git-0:2.27.0-5.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2024-08-29T00:00:00Z",
    "advisory" : "RHSA-2024:6027",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "git-0:2.31.8-3.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2024-08-29T00:00:00Z",
    "advisory" : "RHSA-2024:6027",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "git-0:2.31.8-3.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2024-08-29T00:00:00Z",
    "advisory" : "RHSA-2024:6027",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "git-0:2.31.8-3.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-07-16T00:00:00Z",
    "advisory" : "RHSA-2024:4579",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.8",
    "package" : "git-0:2.39.5-1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-06-25T00:00:00Z",
    "advisory" : "RHSA-2024:4083",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "git-0:2.43.5-1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-09-11T00:00:00Z",
    "advisory" : "RHSA-2024:6610",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "git-0:2.31.1-6.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-07-08T00:00:00Z",
    "advisory" : "RHSA-2024:4368",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "git-0:2.39.5-1.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "git",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "git",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "git",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Out of support scope",
    "package_name" : "git",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Software Collections",
    "fix_state" : "Out of support scope",
    "package_name" : "rh-git227-git",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-32004\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-32004\nhttps://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389" ],
  "name" : "CVE-2024-32004",
  "mitigation" : {
    "value" : "Exercise caution when cloning repositories from untrusted sources.",
    "lang" : "en:us"
  },
  "csaw" : false
}