Securing Git: Addressing 5 new vulnerabilities
Blog post from GitHub
Git has released version 2.45.1 on May 14, 2024, addressing five vulnerabilities affecting various platforms including Windows, macOS, Linux, and *BSD, highlighting the project's dedication to security. These vulnerabilities, identified as CVE-2024-32002, CVE-2024-32004, CVE-2024-32465, CVE-2024-32020, and CVE-2024-32021, range from critical to low severity and involve risks like Remote Code Execution and unauthorized code execution during cloning operations. The release includes defense-in-depth updates, focusing on improving the security of cloning Git repositories and preventing execution of unsafe hooks, especially in environments with submodules and multi-user setups. Users are strongly advised to upgrade to this latest version to safeguard against these threats, and if immediate updates are not possible, caution is advised when cloning repositories. While the update improves overall security, it introduces a regression when cloning repositories with Git LFS, requiring a workaround by executing `git lfs pull`.