suse-su-2025:20049-1
Vulnerability from csaf_suse
Published
2025-02-03 08:55
Modified
2025-02-03 08:55
Summary
Security update for git

Notes

Title of the patch
Security update for git
Description of the patch
This update for git fixes the following issues: git was updated to 2.45.1: * CVE-2024-32002: recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion (bsc#1224168) * CVE-2024-32004: arbitrary code execution during local clones (bsc#1224170) * CVE-2024-32020: file overwriting vulnerability during local clones (bsc#1224171) * CVE-2024-32021: git may create hardlinks to arbitrary user- readable files (bsc#1224172) * CVE-2024-32465: arbitrary code execution during clone operations (bsc#1224173) Update to 2.45.0: * Improved efficiency managing repositories with many references ("git init --ref-format=reftable") * "git checkout -p" and friends learned that that "@" is a synonym for "HEAD" * cli improvements handling refs * Expanded a number of commands and options, UI improvements * status.showUntrackedFiles now accepts "true" * git-cherry-pick(1) now automatically drops redundant commits with new --empty option * The userdiff patterns for C# has been updated. Update to 2.44.0: * "git checkout -B <branch>" now longer allows switching to a branch that is in use on another worktree. The users need to use "--ignore-other-worktrees" option. * Faster server-side rebases with git replay * Faster pack generation with multi-pack reuse * rebase auto-squashing now works in non-interactive mode * pathspec now understands attr, e.g. ':(attr:~binary) for selecting non-binaries, or builtin_objectmode for selecting items by file mode or other properties * Many other cli UI and internal improvements and extensions - Do not replace apparmor configuration, fixes bsc#1216545 Update to 2.43.2: * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.2.txt * Update to a new feature recently added, "git show-ref --exists". * Rename detection logic ignored the final line of a file if it is an incomplete line. * "git diff --no-rename A B" did not disable rename detection but did not trigger an error from the command line parser. * "git diff --no-index file1 file2" segfaulted while invoking the external diff driver, which has been corrected. * A failed "git tag -s" did not necessarily result in an error depending on the crypto backend, which has been corrected. * "git stash" sometimes was silent even when it failed due to unwritable index file, which has been corrected. * Recent conversion to allow more than 0/1 in GIT_FLUSH broke the mechanism by flipping what yes/no means by mistake, which has been corrected. Update to 2.43.1: * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.1.txt - gitweb AppArmor profile: allow reading etc/gitweb-common.conf (bsc#1218664) - git moved to /usr/libexec/git/git, update AppArmor profile accordingly (bsc#1218588) Update to 2.43.0: * The "--rfc" option of "git format-patch" used to be a valid way to override an earlier "--subject-prefix=<something>" on the command line and replace it with "[RFC PATCH]", but from this release, it merely prefixes the string "RFC " in front of the given subject prefix. If you are negatively affected by this change, please use "--subject-prefix=PATCH --rfc" as a replacement. * In Git 2.42, "git rev-list --stdin" learned to take non-revisions (like "--not") from the standard input, but the way such a "--not" was handled was quite confusing, which has been rethought. The updated rule is that "--not" given from the command line only affects revs given from the command line that comes but not revs read from the standard input, and "--not" read from the standard input affects revs given from the standard input and not revs given from the command line. * A message written in olden time prevented a branch from getting checked out, saying it is already checked out elsewhere. But these days, we treat a branch that is being bisected or rebased just like a branch that is checked out and protect it from getting modified with the same codepath. The message has been rephrased to say that the branch is "in use" to avoid confusion. * Hourly and other schedules of "git maintenance" jobs are randomly distributed now. * "git cmd -h" learned to signal which options can be negated by listing such options like "--[no-]opt". * The way authentication related data other than passwords (e.g., oauth token and password expiration data) are stored in libsecret keyrings has been rethought. * Update the libsecret and wincred credential helpers to correctly match which credential to erase; they erased the wrong entry in some cases. * Git GUI updates. * "git format-patch" learned a new "--description-file" option that lets cover letter description to be fed; this can be used on detached HEAD where there is no branch description available, and also can override the branch description if there is one. * Use of the "--max-pack-size" option to allow multiple packfiles to be created is now supported even when we are sending unreachable objects to cruft packs. * "git format-patch --rfc --subject-prefix=<foo>" used to ignore the "--subject-prefix" option and used "[RFC PATCH]"; now we will add "RFC" prefix to whatever subject prefix is specified. * "git log --format" has been taught the %(decorate) placeholder for further customization over what the "--decorate" option offers. * The default log message created by "git revert", when reverting a commit that records a revert, has been tweaked, to encourage people to describe complex "revert of revert of revert" situations better in their own words. * The command-line completion support (in contrib/) learned to complete "git commit --trailer=" for possible trailer keys. * "git update-index" learned the "--show-index-version" option to inspect the index format version used by the on-disk index file. * "git diff" learned the "diff.statNameWidth" configuration variable, to give the default width for the name part in the "--stat" output. * "git range-diff --notes=foo" compared "log --notes=foo --notes" of the two ranges, instead of using just the specified notes tree, which has been corrected to use only the specified notes tree. * The command line completion script (in contrib/) can be told to complete aliases by including ": git <cmd> ;" in the alias to tell it that the alias should be completed in a similar way to how "git <cmd>" is completed. The parsing code for the alias has been loosened to allow ';' without an extra space before it. * "git for-each-ref" and friends learned to apply mailmap to authorname and other fields in a more flexible way than using separate placeholder letters like %a[eElL] every time we want to come up with small variants. * "git repack" machinery learned to pay attention to the "--filter=" option. * "git repack" learned the "--max-cruft-size" option to prevent cruft packs from growing without bounds. * "git merge-tree" learned to take strategy backend specific options via the "-X" option, like "git merge" does. * "git log" and friends learned the "--dd" option that is a short-hand for "--diff-merges=first-parent -p". * The attribute subsystem learned to honor the "attr.tree" configuration variable that specifies which tree to read the .gitattributes files from. * "git merge-file" learns a mode to read three variants of the contents to be merged from blob objects. * see https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.0.txt Update 2.42.1: * Fix "git diff" exit code handling
Patchnames
SUSE-SLE-Micro-6.0-48
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for git",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for git fixes the following issues:\n\ngit was updated to 2.45.1:\n\n * CVE-2024-32002: recursive clones on case-insensitive\n   filesystems that support symbolic links are susceptible to case\n   confusion (bsc#1224168)\n * CVE-2024-32004: arbitrary code execution during local clones\n   (bsc#1224170)\n * CVE-2024-32020: file overwriting vulnerability during local\n   clones (bsc#1224171)\n * CVE-2024-32021: git may create hardlinks to arbitrary user-\n   readable files (bsc#1224172)\n * CVE-2024-32465: arbitrary code execution during clone operations\n   (bsc#1224173)\n\nUpdate to 2.45.0:\n\n  * Improved efficiency managing repositories with many references\n    (\"git init --ref-format=reftable\")\n  * \"git checkout -p\" and friends learned that that \"@\" is a\n    synonym for \"HEAD\"\n  * cli improvements handling refs\n  * Expanded a number of commands and options, UI improvements\n  * status.showUntrackedFiles now accepts \"true\"\n  * git-cherry-pick(1) now automatically drops redundant commits\n    with new --empty option\n  * The userdiff patterns for C# has been updated.\n\nUpdate to 2.44.0:\n\n  * \"git checkout -B \u003cbranch\u003e\" now longer allows switching to a\n    branch that is in use on another worktree. The users need to\n    use \"--ignore-other-worktrees\" option.\n  * Faster server-side rebases with git replay\n  * Faster pack generation with multi-pack reuse\n  * rebase auto-squashing now works in non-interactive mode\n  * pathspec now understands attr, e.g. \u0027:(attr:~binary) for\n    selecting non-binaries, or builtin_objectmode for selecting\n    items by file mode or other properties\n  * Many other cli UI and internal improvements and extensions\n\n- Do not replace apparmor configuration, fixes bsc#1216545\n\nUpdate to 2.43.2:\n\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.2.txt\n  * Update to a new feature recently added, \"git show-ref --exists\".\n  * Rename detection logic ignored the final line of a file if it\n    is an incomplete line.\n  * \"git diff --no-rename A B\" did not disable rename detection but\n    did not trigger an error from the command line parser.\n  * \"git diff --no-index file1 file2\" segfaulted while invoking the\n    external diff driver, which has been corrected.\n  * A failed \"git tag -s\" did not necessarily result in an error\n    depending on the crypto backend, which has been corrected.\n  * \"git stash\" sometimes was silent even when it failed due to\n    unwritable index file, which has been corrected.\n  * Recent conversion to allow more than 0/1 in GIT_FLUSH broke the\n    mechanism by flipping what yes/no means by mistake, which has\n    been corrected.\n\nUpdate to 2.43.1:\n\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.1.txt\n\n- gitweb AppArmor profile: allow reading etc/gitweb-common.conf\n  (bsc#1218664)\n\n- git moved to /usr/libexec/git/git, update AppArmor profile\n  accordingly (bsc#1218588)\n\nUpdate to 2.43.0:\n\n * The \"--rfc\" option of \"git format-patch\" used to be a valid way to\n   override an earlier \"--subject-prefix=\u003csomething\u003e\" on the command\n   line and replace it with \"[RFC PATCH]\", but from this release, it\n   merely prefixes the string \"RFC \" in front of the given subject\n   prefix.  If you are negatively affected by this change, please use\n   \"--subject-prefix=PATCH --rfc\" as a replacement.\n * In Git 2.42, \"git rev-list --stdin\" learned to take non-revisions\n   (like \"--not\") from the standard input, but the way such a \"--not\" was\n   handled was quite confusing, which has been rethought.  The updated\n   rule is that \"--not\" given from the command line only affects revs\n   given from the command line that comes but not revs read from the\n   standard input, and \"--not\" read from the standard input affects\n   revs given from the standard input and not revs given from the\n   command line.\n * A message written in olden time prevented a branch from getting\n   checked out, saying it is already checked out elsewhere. But these\n   days, we treat a branch that is being bisected or rebased just like\n   a branch that is checked out and protect it from getting modified\n   with the same codepath.  The message has been rephrased to say that\n   the branch is \"in use\" to avoid confusion.\n * Hourly and other schedules of \"git maintenance\" jobs are randomly\n   distributed now.\n * \"git cmd -h\" learned to signal which options can be negated by\n   listing such options like \"--[no-]opt\".\n * The way authentication related data other than passwords (e.g.,\n   oauth token and password expiration data) are stored in libsecret\n   keyrings has been rethought.\n * Update the libsecret and wincred credential helpers to correctly\n   match which credential to erase; they erased the wrong entry in\n   some cases.\n * Git GUI updates.\n * \"git format-patch\" learned a new \"--description-file\" option that\n   lets cover letter description to be fed; this can be used on\n   detached HEAD where there is no branch description available, and\n   also can override the branch description if there is one.\n * Use of the \"--max-pack-size\" option to allow multiple packfiles to\n   be created is now supported even when we are sending unreachable\n   objects to cruft packs.\n * \"git format-patch --rfc --subject-prefix=\u003cfoo\u003e\" used to ignore the\n   \"--subject-prefix\" option and used \"[RFC PATCH]\"; now we will add\n   \"RFC\" prefix to whatever subject prefix is specified.\n * \"git log --format\" has been taught the %(decorate) placeholder for\n   further customization over what the \"--decorate\" option offers.\n * The default log message created by \"git revert\", when reverting a\n   commit that records a revert, has been tweaked, to encourage people\n   to describe complex \"revert of revert of revert\" situations better in\n   their own words.\n * The command-line completion support (in contrib/) learned to\n   complete \"git commit --trailer=\" for possible trailer keys.\n * \"git update-index\" learned the \"--show-index-version\" option to\n   inspect the index format version used by the on-disk index file.\n * \"git diff\" learned the \"diff.statNameWidth\" configuration variable,\n   to give the default width for the name part in the \"--stat\" output.\n * \"git range-diff --notes=foo\" compared \"log --notes=foo --notes\" of\n   the two ranges, instead of using just the specified notes tree,\n   which has been corrected to use only the specified notes tree.\n * The command line completion script (in contrib/) can be told to\n   complete aliases by including \": git \u003ccmd\u003e ;\" in the alias to tell\n   it that the alias should be completed in a similar way to how \"git\n   \u003ccmd\u003e\" is completed.  The parsing code for the alias has been\n   loosened to allow \u0027;\u0027 without an extra space before it.\n * \"git for-each-ref\" and friends learned to apply mailmap to\n   authorname and other fields in a more flexible way than using\n   separate placeholder letters like %a[eElL] every time we want to\n   come up with small variants.\n * \"git repack\" machinery learned to pay attention to the \"--filter=\"\n   option.\n * \"git repack\" learned the \"--max-cruft-size\" option to prevent cruft\n   packs from growing without bounds.\n * \"git merge-tree\" learned to take strategy backend specific options\n   via the \"-X\" option, like \"git merge\" does.\n * \"git log\" and friends learned the \"--dd\" option that is a\n   short-hand for \"--diff-merges=first-parent -p\".\n * The attribute subsystem learned to honor the \"attr.tree\"\n   configuration variable that specifies which tree to read the\n   .gitattributes files from.\n * \"git merge-file\" learns a mode to read three variants of the\n   contents to be merged from blob objects.\n * see https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.0.txt\n\nUpdate 2.42.1:\n\n  * Fix \"git diff\" exit code handling\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-48",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20049-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20049-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520049-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20049-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021288.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1042640",
        "url": "https://bugzilla.suse.com/1042640"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1061041",
        "url": "https://bugzilla.suse.com/1061041"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1069468",
        "url": "https://bugzilla.suse.com/1069468"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1082023",
        "url": "https://bugzilla.suse.com/1082023"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1216545",
        "url": "https://bugzilla.suse.com/1216545"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1218588",
        "url": "https://bugzilla.suse.com/1218588"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1218664",
        "url": "https://bugzilla.suse.com/1218664"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224168",
        "url": "https://bugzilla.suse.com/1224168"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224170",
        "url": "https://bugzilla.suse.com/1224170"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224171",
        "url": "https://bugzilla.suse.com/1224171"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224172",
        "url": "https://bugzilla.suse.com/1224172"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224173",
        "url": "https://bugzilla.suse.com/1224173"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 779536",
        "url": "https://bugzilla.suse.com/779536"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2005-4900 page",
        "url": "https://www.suse.com/security/cve/CVE-2005-4900/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-14867 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-14867/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-32002 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-32002/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-32004 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-32004/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-32020 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-32020/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-32021 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-32021/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-32465 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-32465/"
      }
    ],
    "title": "Security update for git",
    "tracking": {
      "current_release_date": "2025-02-03T08:55:36Z",
      "generator": {
        "date": "2025-02-03T08:55:36Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20049-1",
      "initial_release_date": "2025-02-03T08:55:36Z",
      "revision_history": [
        {
          "date": "2025-02-03T08:55:36Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-2.45.1-1.1.aarch64",
                "product": {
                  "name": "git-2.45.1-1.1.aarch64",
                  "product_id": "git-2.45.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "git-core-2.45.1-1.1.aarch64",
                "product": {
                  "name": "git-core-2.45.1-1.1.aarch64",
                  "product_id": "git-core-2.45.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "perl-Git-2.45.1-1.1.aarch64",
                "product": {
                  "name": "perl-Git-2.45.1-1.1.aarch64",
                  "product_id": "perl-Git-2.45.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-2.45.1-1.1.s390x",
                "product": {
                  "name": "git-2.45.1-1.1.s390x",
                  "product_id": "git-2.45.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "git-core-2.45.1-1.1.s390x",
                "product": {
                  "name": "git-core-2.45.1-1.1.s390x",
                  "product_id": "git-core-2.45.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "perl-Git-2.45.1-1.1.s390x",
                "product": {
                  "name": "perl-Git-2.45.1-1.1.s390x",
                  "product_id": "perl-Git-2.45.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-2.45.1-1.1.x86_64",
                "product": {
                  "name": "git-2.45.1-1.1.x86_64",
                  "product_id": "git-2.45.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "git-core-2.45.1-1.1.x86_64",
                "product": {
                  "name": "git-core-2.45.1-1.1.x86_64",
                  "product_id": "git-core-2.45.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "perl-Git-2.45.1-1.1.x86_64",
                "product": {
                  "name": "perl-Git-2.45.1-1.1.x86_64",
                  "product_id": "perl-Git-2.45.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-2.45.1-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64"
        },
        "product_reference": "git-2.45.1-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-2.45.1-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x"
        },
        "product_reference": "git-2.45.1-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-2.45.1-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64"
        },
        "product_reference": "git-2.45.1-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-core-2.45.1-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64"
        },
        "product_reference": "git-core-2.45.1-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-core-2.45.1-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x"
        },
        "product_reference": "git-core-2.45.1-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-core-2.45.1-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64"
        },
        "product_reference": "git-core-2.45.1-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Git-2.45.1-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64"
        },
        "product_reference": "perl-Git-2.45.1-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Git-2.45.1-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x"
        },
        "product_reference": "perl-Git-2.45.1-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Git-2.45.1-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        },
        "product_reference": "perl-Git-2.45.1-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2005-4900",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2005-4900"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2.  NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2005-4900",
          "url": "https://www.suse.com/security/cve/CVE-2005-4900"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1026646 for CVE-2005-4900",
          "url": "https://bugzilla.suse.com/1026646"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1026936 for CVE-2005-4900",
          "url": "https://bugzilla.suse.com/1026936"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1042640 for CVE-2005-4900",
          "url": "https://bugzilla.suse.com/1042640"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1150998 for CVE-2005-4900",
          "url": "https://bugzilla.suse.com/1150998"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2005-4900"
    },
    {
      "cve": "CVE-2017-14867",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-14867"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-14867",
          "url": "https://www.suse.com/security/cve/CVE-2017-14867"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1060377 for CVE-2017-14867",
          "url": "https://bugzilla.suse.com/1060377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1060378 for CVE-2017-14867",
          "url": "https://bugzilla.suse.com/1060378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1061041 for CVE-2017-14867",
          "url": "https://bugzilla.suse.com/1061041"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-14867"
    },
    {
      "cve": "CVE-2024-32002",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-32002"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule\u0027s worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won\u0027t work. As always, it is best to avoid cloning repositories from untrusted sources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-32002",
          "url": "https://www.suse.com/security/cve/CVE-2024-32002"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224168 for CVE-2024-32002",
          "url": "https://bugzilla.suse.com/1224168"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224170 for CVE-2024-32002",
          "url": "https://bugzilla.suse.com/1224170"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-32002"
    },
    {
      "cve": "CVE-2024-32004",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-32004"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-32004",
          "url": "https://www.suse.com/security/cve/CVE-2024-32004"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224170 for CVE-2024-32004",
          "url": "https://bugzilla.suse.com/1224170"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-32004"
    },
    {
      "cve": "CVE-2024-32020",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-32020"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository\u0027s object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a \"proper\" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-32020",
          "url": "https://www.suse.com/security/cve/CVE-2024-32020"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224171 for CVE-2024-32020",
          "url": "https://bugzilla.suse.com/1224171"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-32020"
    },
    {
      "cve": "CVE-2024-32021",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-32021"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository\u0027s `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning\nwill be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-32021",
          "url": "https://www.suse.com/security/cve/CVE-2024-32021"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224172 for CVE-2024-32021",
          "url": "https://bugzilla.suse.com/1224172"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-32021"
    },
    {
      "cve": "CVE-2024-32465",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-32465"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
          "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-32465",
          "url": "https://www.suse.com/security/cve/CVE-2024-32465"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224170 for CVE-2024-32465",
          "url": "https://bugzilla.suse.com/1224170"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224173 for CVE-2024-32465",
          "url": "https://bugzilla.suse.com/1224173"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:git-core-2.45.1-1.1.x86_64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.aarch64",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.s390x",
            "SUSE Linux Micro 6.0:perl-Git-2.45.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-03T08:55:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-32465"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.