Git path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in Git. The impacted element is an unknown function. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2024-32465. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Git (affected version unknown) and classified as critical. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

The advisory is available at github.com. This vulnerability was named CVE-2024-32465 since 04/12/2024. The exploitation appears to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 214460 (SUSE SLES12 Security Update : git (SUSE-SU-2025:0197-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214460). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Versioning Software

Name

• Git

License

• open-source

Website

• Product: https://github.com/git/git/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion