Debian Git vulnerabilities

CVE-2024-32465 [HIGH] CVE-2024-32465: git - Git is a revision control system. The Git project recommends to avoid working in... Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of clonin

CVE-2024-32021 [MEDIUM] CVE-2024-32021: git - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42... Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the files

CVE-2023-22490 [MEDIUM] CVE-2023-22490: git - Git is a revision control system. Using a specially-crafted repository, Git prio... Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic link

CVE-2022-39253 [MEDIUM] CVE-2022-39253: git - Git is an open source, scalable, distributed revision control system. Versions p... Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_D

CVE-2024-50349 [LOW] CVE-2024-50349: git - Git is a fast, scalable, distributed revision control system with an unusually r... Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this st

CVE-2017-15298 [MEDIUM] CVE-2017-15298: git - Git through 2.14.2 mishandles layers of tree objects, which allows remote attack... Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk. Scope: local

CVE-2025-27613 [LOW] CVE-2025-27613: git - Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clo... Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same ha

CVE-2019-1348 [LOW] CVE-2019-1348: git - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2... An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths. Scope: local bookworm: resolved (fixed in 1:2.24.0-2) bullseye: resolved (fixed in 1

CVE-2024-32020 [LOW] CVE-2024-32020: git - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42... Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in

CVE-2023-25815 [LOW] CVE-2023-25815: git - In Git for Windows, the Windows port of Git, no localized messages are shipped w... In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64