Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

SUSE: 2024:1807-1 Important: Git Execution Risk Advisory

suse
Calendar Grey May 29, 2024
Dist Suse Esm H88
Essential patches for git security flaws identified within SUSE environments, addressing problems such as case sensitivity errors and potential execution of unauthorized code.
* bsc#1224168 * bsc#1224170 * bsc#1224171 * bsc#1224172 * bsc#1224173

Summary

## This update for git fixes the following issues: * CVE-2024-32002: Fixed recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion (bsc#1224168). * CVE-2024-32004: Fixed arbitrary code execution during local clones (bsc#1224170). * CVE-2024-32020: Fixed file overwriting vulnerability during local clones (bsc#1224171). * CVE-2024-32021: Fixed git may create hardlinks to arbitrary user-readable files (bsc#1224172). * CVE-2024-32465: Fixed arbitrary code execution during clone operations (bsc#1224173). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5

Topics%20covered

Topics Covered

security advisory software update code execution vulnerability SUSE git case confusion

References

* bsc#1224168

* bsc#1224170

* bsc#1224171

* bsc#1224172

* bsc#1224173

Cross-

* CVE-2024-32002

* CVE-2024-32004

* CVE-2024-32020

* CVE-2024-32021

* CVE-2024-32465

CVSS scores:

* CVE-2024-32002 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2024-32002 ( NVD ): 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

* CVE-2024-32004 ( SUSE ): 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

* CVE-2024-32020 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L

* CVE-2024-32021 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L

* CVE-2024-32465 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

* Basesystem Module 15-SP5

* Development Tools Module 15-SP5

* openSUSE Leap 15.3

* openSUSE Leap 15.5

* SUSE Enterprise Storage 7.1

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:1807-1
Rating: important

Topics%20covered

Topics Covered

security advisory software update code execution vulnerability SUSE git case confusion

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here