CVE-2024-10007: Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation
First published: Thu Nov 07 2024(Updated: )
A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administrator access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise prior to 3.15 and was fixed in versions 3.14.3, 3.13.6, 3.12.11, and 3.11.17. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise | <3.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.17
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.11
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.6
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.3
Frequently Asked Questions
What is the severity of CVE-2024-10007?
CVE-2024-10007 is classified as a critical vulnerability due to its potential for arbitrary code execution and escalation of privileges.
How do I fix CVE-2024-10007?
To mitigate CVE-2024-10007, you should upgrade your GitHub Enterprise Server to version 3.15 or later.
What impact does CVE-2024-10007 have on my system?
Exploitation of CVE-2024-10007 can lead to unauthorized access and control over your GitHub Enterprise Server environment.
Who is affected by CVE-2024-10007?
CVE-2024-10007 affects installations of GitHub Enterprise Server versions prior to 3.15 that are managed by an Enterprise Administrator.
Is it safe to use GitHub Enterprise Server with CVE-2024-10007 vulnerability?
Using vulnerable versions of GitHub Enterprise Server exposes your system to high-security risks and should be addressed immediately by applying the necessary updates.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/github
- canonical/github enterprise