The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create     hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the     `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary     user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning     a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`),     the optimizations for local cloning will be used, which include attempting to hard link the object files     instead of copying them. While the code includes checks against symbolic links in the source repository,     which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link     operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check,     and then a symlink during the operation, this will allow the adversary to bypass the check and create     hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been     patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. (CVE-2024-32021)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 7.02, has git packages installed that are affected by multiple vulnerabilities:

  - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary     code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2,     2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.
    (CVE-2024-32004)

  - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, local clones may end up hardlinking files into the target repository's object database when source     and target repository reside on the same disk. If the source repository is owned by a different user, then     those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local     repositories will cause Git to either copy or hardlink files of the source repository into the target     repository. This significantly speeds up such local clones compared to doing a proper clone and saves     both disk space and compute time. When cloning a repository located on the same disk that is owned by a     different user than the current user we also end up creating such hardlinks. These files will continue to     be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the     future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4. (CVE-2024-32020)

  - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create     hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the     `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary     user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning     a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`),     the optimizations for local cloning will be used, which include attempting to hard link the object files     instead of copying them. While the code includes checks against symbolic links in the source repository,     which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link     operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check,     and then a symlink during the operation, this will allow the adversary to bypass the check and create     hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been     patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. (CVE-2024-32021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.40.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2548 advisory.

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be     fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows     writing a hook that will be executed while the clone operation is still running, giving the user no     opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1,     2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via     `git config --global core.symlinks false`), the described attack won't work. As always, it is best to     avoid cloning repositories from untrusted sources. (CVE-2024-32002)

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary     code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2,     2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.
    (CVE-2024-32004)

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, local clones may end up hardlinking files into the target repository's object database when source     and target repository reside on the same disk. If the source repository is owned by a different user, then     those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local     repositories will cause Git to either copy or hardlink files of the source repository into the target     repository. This significantly speeds up such local clones compared to doing a proper clone and saves     both disk space and compute time. When cloning a repository located on the same disk that is owned by a     different user than the current user we also end up creating such hardlinks. These files will continue to     be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the     future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4. (CVE-2024-32020)

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create     hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the     `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary     user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning     a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`),     the optimizations for local cloningwill be used, which include attempting to hard link the object files     instead of copying them. While the code includes checks against symbolic links in the source repository,     which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link     operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check,     and then a symlink during the operation, this will allow the adversary to bypass the check and create     hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been     patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. (CVE-2024-32021)

    Git is a revision control system. The Git project recommends to avoid working in untrusted repositories,     and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific     protections to make that a safe operation even with an untrusted source repository, but vulnerabilities     allow those protections to be bypassed. In the context of cloning local repositories owned by other users,     this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for     CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git     repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run     within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4,     2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been     obtained via archives from untrusted sources. (CVE-2024-32465)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4084 advisory.

    [2.43.5-1]
    - Update to 2.43.5
    - Related: RHEL-36399, RHEL-36411

    [2.43.4-1]
    - Update to 2.43.4
    - Resolves: RHEL-36399, RHEL-36411

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4083 advisory.

    * git: Recursive clones RCE (CVE-2024-32002)

    * git: RCE while cloning local repos (CVE-2024-32004)

    * git: additional local RCE (CVE-2024-32465)

    * git: insecure hardlinks (CVE-2024-32020)

    * git: symlink bypass (CVE-2024-32021)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Git for Windows installed on the remote host is prior to 2.45.1, and therefore is affected by multiple vulnerabilities:

  - Recursive clones on case-insensitive filesystems that     support symbolic links are susceptible to case confusion     that can be exploited to execute just-cloned code during     the clone operation. (CVE-2024-32002)

  - Repositories can be configured to execute arbitrary code     during local clones. To address this, the ownership     checks introduced in v2.30.3 are now extended to cover     cloning local repositories. (CVE-2024-32004)

  - Local clones may end up hardlinking files into the target     repository's object database when source and target     repository reside on the same disk. If the source     repository is owned by a different user, then those     hardlinked files may be rewritten at any point in time     by the untrusted user. (CVE-2024-32020)

  - When cloning a local source repository that contains     symlinks via the filesystem, Git may create hardlinks     to arbitrary user-readable files on the same filesystem     as the target repository in the objects/ directory.     (CVE-2024-32021)

  - It is supposed to be safe to clone untrusted repositories,     even those unpacked from zip archives or tarballs     originating from untrusted sources, but Git can be tricked     to run arbitrary code as part of the clone.(CVE-2024-32465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be     fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows     writing a hook that will be executed while the clone operation is still running, giving the user no     opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1,     2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via     `git config --global core.symlinks false`), the described attack won't work. As always, it is best to     avoid cloning repositories from untrusted sources.(CVE-2024-32002)

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, local clones may end up hardlinking files into the target repository's object database when source     and target repository reside on the same disk. If the source repository is owned by a different user, then     those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local     repositories will cause Git to either copy or hardlink files of the source repository into the target     repository. This significantly speeds up such local clones compared to doing a 'proper' clone and saves     both disk space and compute time. When cloning a repository located on the same disk that is owned by a     different user than the current user we also end up creating such hardlinks. These files will continue to     be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the     future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4.(CVE-2024-32020)

    Git is a revision control system. The Git project recommends to avoid working in untrusted repositories,     and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific     protections to make that a safe operation even with an untrusted source repository, but vulnerabilities     allow those protections to be bypassed. In the context of cloning local repositories owned by other users,     this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for     CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git     repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run     within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4,     2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been     obtained via archives from untrusted sources.(CVE-2024-32465)

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary     code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2,     2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted     sources.(CVE-2024-32004)

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and     2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create     hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the     `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary     user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning     a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`),     the optimizations for local cloning will be used, which include attempting to hard link the object files     instead of copying them. While the code includes checks against symbolic links in the source repository,     which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link     operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check,     and then a symlink during the operation, this will allow the adversary to bypass the check and create     hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been     patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.(CVE-2024-32021)

Tenable has extracted the preceding description block directly from the EulerOS git security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3867 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3867-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     September 03, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : git     Version        : 1:2.30.2-1+deb11u3     CVE ID         : CVE-2019-1387 CVE-2023-25652 CVE-2023-25815 CVE-2023-29007                      CVE-2024-32002 CVE-2024-32004 CVE-2024-32021 CVE-2024-32465     Debian Bug     : 1034835 1071160

    Multiple vulnerabilities were discovered in git, a fast, scalable and     distributed revision control system.

    CVE-2019-1387

        It was possible to bypass the previous check for this vulnerability         using parallel cloning, or the --recurse-submodules option to         git-checkout(1).

    CVE-2023-25652

        Feeding specially-crafted input to 'git apply --reject' could         overwrite a path outside the working tree with partially controlled         contents, corresponding to the rejected hunk or hunks from the given         patch.

    CVE-2023-25815

        Low-privileged users could inject malicious messages into Git's         output under MINGW.

    CVE-2023-29007

        A specially-crafted .gitmodules file with submodule URLs longer than         1024 characters could be used to inject arbitrary configuration into         $GIT_DIR/config.

    CVE-2024-32002

        Repositories with submodules could be specially-crafted to write         hooks into .git/ which would then be executed during an ongoing         clone operation.

    CVE-2024-32004

        A specially-crafted local repository could cause the execution of         arbitrary code when cloned by another user.

    CVE-2024-32021

        When cloning a local repository that contains symlinks via the         filesystem, Git could have created hardlinks to arbitrary         user-readable files on the same filesystem as the target repository         in the objects/ directory.

    CVE-2024-32465

        When cloning a local repository obtained from a downloaded archive,         hooks in that repository could be used for arbitrary code execution.

    For Debian 11 bullseye, these problems have been fixed in version     1:2.30.2-1+deb11u3.

    We recommend that you upgrade your git packages.

    For the detailed security status of git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5769 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5769-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 13, 2024                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : git     CVE ID         : CVE-2023-25652 CVE-2023-25815 CVE-2023-29007 CVE-2024-32002                      CVE-2024-32004 CVE-2024-32020 CVE-2024-32021 CVE-2024-32465     Debian Bug     : 1034835 1071160

    Multiple issues were found in Git, a fast, scalable, distributed     revision control system, which may result in file overwrites outside the     repository, arbitrary configuration injection or arbitrary code     execution.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:2.39.5-0+deb12u1.

    We recommend that you upgrade your git packages.

    For the detailed security status of git please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/git

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8465:07 advisory.

    * git: Recursive clones RCE (CVE-2024-32002)
      * git: RCE while cloning local repos (CVE-2024-32004)
      * git: additional local RCE (CVE-2024-32465)
      * git: insecure hardlinks (CVE-2024-32020)
      * git: symlink bypass (CVE-2024-32021)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
260256	Linux Distros Unpatched Vulnerability : CVE-2024-32021	Nessus	Misc.	2025/9/2	2025/9/2	low
271297	NewStart CGSL MAIN 7.02 : git Multiple Vulnerabilities (NS-SA-2025-0249)	Nessus	NewStart CGSL Local Security Checks	2025/10/24	2025/10/24	high
198267	Amazon Linux 2 : git (ALAS-2024-2548)	Nessus	Amazon Linux Local Security Checks	2024/5/31	2024/12/11	critical
200998	Oracle Linux 8 : git (ELSA-2024-4084)	Nessus	Oracle Linux Local Security Checks	2024/6/25	2025/9/9	critical
201239	Rocky Linux 9 : git (RLSA-2024:4083)	Nessus	Rocky Linux Local Security Checks	2024/7/2	2024/7/2	critical
202262	Git for Windows < 2.45.1 Multiple Vulnerabilities	Nessus	Windows	2024/7/12	2024/7/15	critical
205237	EulerOS 2.0 SP11 : git (EulerOS-SA-2024-2098)	Nessus	Huawei Local Security Checks	2024/8/8	2024/8/8	critical
206452	Debian dla-3867 : git - security update	Nessus	Debian Local Security Checks	2024/9/3	2024/9/3	critical
207248	Debian dsa-5769 : git - security update	Nessus	Debian Local Security Checks	2024/9/13	2024/9/13	critical
293641	MiracleLinux 9 : git-2.43.5-1.el9_4 (AXSA:2024-8465:07)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

low

high

critical

critical

critical

critical

critical

critical

critical

critical