Linux · Security advisory · June 25, 2024

ALSA-2024:4084: Security update for 15 packages

ALSA-2024:4084, released June 25, 2024, fixes 5 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2923
98th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 4 Routine 1

Fixed package versions

ProductReleaseFixed in
gitalmalinux 82.43.5-1.el8_10
git-allalmalinux 82.43.5-1.el8_10
git-corealmalinux 82.43.5-1.el8_10
git-core-docalmalinux 82.43.5-1.el8_10
git-credential-libsecretalmalinux 82.43.5-1.el8_10
git-daemonalmalinux 82.43.5-1.el8_10
git-emailalmalinux 82.43.5-1.el8_10
git-guialmalinux 82.43.5-1.el8_10
git-instawebalmalinux 82.43.5-1.el8_10
git-subtreealmalinux 82.43.5-1.el8_10
git-svnalmalinux 82.43.5-1.el8_10
gitkalmalinux 82.43.5-1.el8_10
gitwebalmalinux 82.43.5-1.el8_10
perl-Gitalmalinux 82.43.5-1.el8_10
perl-Git-SVNalmalinux 82.43.5-1.el8_10

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2024-32002 GitHub: CVE-2024-32002 Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution 9.0 0.2923 Exploitation Less Likely
High CVE-2024-32004 GitHub: CVE-2024-32004 Remote Code Execution while cloning special-crafted local repositories 8.1 0.0135 Exploitation Less Likely
High CVE-2024-32465 Git's protections for cloning untrusted repositories can be bypassed 7.8 0.0103 None reported
High CVE-2024-32021 Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory 7.1 0.0102 None reported
Routine CVE-2024-32020 Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will 3.9 0.0052 None reported
Showing 1 to 5 of 5 1