x/vulndb: potential Go vuln in github.com/git/git: CVE-2024-32465

[GoVulnBot]

CVE-2024-32465 references github.com/git/git, which may be a Go module.

Description:
Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with git clone --no-local to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a .zip file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-32465
• JSON: https://github.com/CVEProject/cvelist/tree/6d9a69bce5c042ad8f2f1fac89e8f681a2d54d6e/2024/32xxx/CVE-2024-32465.json
• advisory: GHSA-vm9j-46j9-qvq4
• fix: git/git@7b70e9e
• web: https://git-scm.com/docs/git#_security
• web: https://git-scm.com/docs/git-clone
• Imported by: https://pkg.go.dev/github.com/git/git?tab=importedby

Cross references:

• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2022-29187 #513 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2022-39253 #1068 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2022-39260 #1069 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2022-23521 #1499 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2022-41903 #1500 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2023-22490 #1562 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2023-23946 #1563 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2023-25652 #1739 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2023-29007 #1741 NOT_GO_CODE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2020-11008 #2266 LEGACY_FALSE_POSITIVE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2020-12278 #2271 LEGACY_FALSE_POSITIVE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2020-12279 #2272 LEGACY_FALSE_POSITIVE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2020-5260 #2304 LEGACY_FALSE_POSITIVE
• Module github.com/git/git appears in issue x/vulndb: potential Go vuln in github.com/git/git: CVE-2021-21300 #2320 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/git/git
      vulnerable_at: 2.45.1+incompatible
      packages:
        - package: git
summary: CVE-2024-32465 in github.com/git/git
cves:
    - CVE-2024-32465
references:
    - advisory: https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4
    - fix: https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7
    - web: https://git-scm.com/docs/git#_security
    - web: https://git-scm.com/docs/git-clone
source:
    id: CVE-2024-32465

[gopherbot]

Change https://go.dev/cl/590855 mentions this issue: data/excluded: add 20 excluded reports