Linux · Security advisory · June 25, 2024

ELSA-2024-4083: Security update for 15 packages

ELSA-2024-4083, released June 25, 2024, fixes 5 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2923
98th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 4 Routine 1

Fixed package versions

ProductReleaseFixed in
gitol 90:2.43.5-1.el9_4
git-allol 90:2.43.5-1.el9_4
git-coreol 90:2.43.5-1.el9_4
git-core-docol 90:2.43.5-1.el9_4
git-credential-libsecretol 90:2.43.5-1.el9_4
git-daemonol 90:2.43.5-1.el9_4
git-emailol 90:2.43.5-1.el9_4
git-guiol 90:2.43.5-1.el9_4
git-instawebol 90:2.43.5-1.el9_4
git-subtreeol 90:2.43.5-1.el9_4
git-svnol 90:2.43.5-1.el9_4
gitkol 90:2.43.5-1.el9_4
gitwebol 90:2.43.5-1.el9_4
perl-Gitol 90:2.43.5-1.el9_4
perl-Git-SVNol 90:2.43.5-1.el9_4

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2024-32002 GitHub: CVE-2024-32002 Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution 9.0 0.2923 Exploitation Less Likely
High CVE-2024-32004 GitHub: CVE-2024-32004 Remote Code Execution while cloning special-crafted local repositories 8.1 0.0135 Exploitation Less Likely
High CVE-2024-32465 Git's protections for cloning untrusted repositories can be bypassed 7.8 0.0103 None reported
High CVE-2024-32021 Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory 7.1 0.0102 None reported
Routine CVE-2024-32020 Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will 3.9 0.0052 None reported
Showing 1 to 5 of 5 1