Home / Companies / GitHub / Blog / Post Details
Content Deep Dive

Securing Git: Addressing 5 new vulnerabilities

Blog post from GitHub

Post Details
Company
Date Published
Author
Johannes Schindelin
Word Count
1,197
Language
English
Hacker News Points
-
Summary

Git has released version 2.45.1 on May 14, 2024, addressing five vulnerabilities affecting various platforms including Windows, macOS, Linux, and *BSD, highlighting the project's dedication to security. These vulnerabilities, identified as CVE-2024-32002, CVE-2024-32004, CVE-2024-32465, CVE-2024-32020, and CVE-2024-32021, range from critical to low severity and involve risks like Remote Code Execution and unauthorized code execution during cloning operations. The release includes defense-in-depth updates, focusing on improving the security of cloning Git repositories and preventing execution of unsafe hooks, especially in environments with submodules and multi-user setups. Users are strongly advised to upgrade to this latest version to safeguard against these threats, and if immediate updates are not possible, caution is advised when cloning repositories. While the update improves overall security, it introduces a regression when cloning repositories with Git LFS, requiring a workaround by executing `git lfs pull`.