CyberzSOC

These vulnerabilities could allow for remote code execution and unauthorised file modifications. The vulnerability CVE-2024-32002 , with a CVSS score of 9.1, could allow a remote attacker to execute code on the affected device. To do so, an attacker would need to craft repositories with submodules in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule’s worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. [3] The vulnerability CVE-2024-32004 , with a CVSS score of 8.2, could allow an attacker, on multiuser machines, to create a local repository that appears as a partial clone that is missing an object. Then, when this repository is cloned, it causes Git to execute arbitrary code with the full permissions of the user performing the clone. [4] The vulnerability CVE-2024-32465 , with a CVSS score of 7.4, could allow an attacker to bypass protections for cloning untrusted repositories.