CVSS: 3.9EPSS: 0%CPEs: 7EXPL: 0CVE-2024-32021 – Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory
https://notcve.org/view.php?id=CVE-2024-32021
14 May 2024 — Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cl... • http://www.openwall.com/lists/oss-security/2024/05/14/2 • CWE-61: UNIX Symbolic Link (Symlink) Following CWE-547: Use of Hard-coded, Security-relevant Constants •
CVSS: 3.9EPSS: 0%CPEs: 7EXPL: 0CVE-2024-32020 – Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will
https://notcve.org/view.php?id=CVE-2024-32020
14 May 2024 — Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the t... • http://www.openwall.com/lists/oss-security/2024/05/14/2 • CWE-62: UNIX Hard Link CWE-281: Improper Preservation of Permissions •
CVSS: 8.1EPSS: 4%CPEs: 7EXPL: 2CVE-2024-32004 – Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
https://notcve.org/view.php?id=CVE-2024-32004
14 May 2024 — Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources. Git es un sistema de control de revisiones. • https://github.com/Wadewfsssss/CVE-2024-32004 • CWE-114: Process Control •
CVSS: 9.0EPSS: 66%CPEs: 7EXPL: 59CVE-2024-32002 – Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-32002
14 May 2024 — Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.4... • https://github.com/amalmurali47/git_rce • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32478 – Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files
https://notcve.org/view.php?id=CVE-2024-32478
19 Apr 2024 — Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0. Git Credential Manager (GCM) es un asistente seguro de credenciales Git. • https://github.com/git-ecosystem/git-credential-manager/commit/d9ac33c5b1478383672b4425f5ecf875a62efba9 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 10.0EPSS: 3%CPEs: 1EXPL: 0CVE-2023-49569 – Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
https://notcve.org/view.php?id=CVE-2023-49569
12 Jan 2024 — A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). • https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49568 – Maliciously crafted Git server replies can cause DoS on go-git clients
https://notcve.org/view.php?id=CVE-2023-49568
12 Jan 2024 — A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli. Se descubrió una vulnerabilidad de denegación... • https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46402
https://notcve.org/view.php?id=CVE-2023-46402
17 Nov 2023 — git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. La versión 1.0.1 de git-urls es vulnerable a ReDOS (Denegación de servicio de expresión regular) en el paquete Go. • https://gist.github.com/6en6ar/7c2424c93e7fbf2b6fc44e7fb9acb95d • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 2CVE-2023-26134
https://notcve.org/view.php?id=CVE-2023-26134
28 Jun 2023 — Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content. • https://github.com/JPeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18c • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33290
https://notcve.org/view.php?id=CVE-2023-33290
12 Jun 2023 — The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python). • https://github.com/tjtelan/git-url-parse-rs/issues/51 • CWE-1333: Inefficient Regular Expression Complexity •