CVE-2024-32478: Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files
Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32478?
CVE-2024-32478 is considered a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2024-32478?
To fix CVE-2024-32478, upgrade to Git Credential Manager version 2.5.0 or later.
What is the impact of CVE-2024-32478 on multi-user systems?
CVE-2024-32478 allows a user to replace binaries, thereby gaining privileges over other users on a multi-user system.
Which versions of Git Credential Manager are affected by CVE-2024-32478?
CVE-2024-32478 affects all versions of Git Credential Manager prior to 2.5.0.
Who is the vendor associated with CVE-2024-32478?
The vendor associated with CVE-2024-32478 is Microsoft, as they develop the Git Credential Manager.