Critical Git vulnerability allows RCE when cloning repositories with submodules (CVE-2024-32002)
Critical Git vulnerability allows RCE when cloning repositories with submodules (CVE-2024-32002)
New versions of Git are out, with fixes for CVE-2024-32002, which can be used to remotely execute code during a "clone" operation.
Yay! I have a better reason to hate submodules now, until it's patched everywhere, at least.
Nice, came here to dunk on submodules, and find there's no need.
Yeah. I wanted to like submodules, but submodules, to me, ended up feeling like one feature too many in
git.I mainly run into submodules that have been setup accidentally by cloning inside an existing clone. That situation is, of course, not great.
Even for the many reasonable use cases for submodules, I generally end up letting my actual package manager do the work, instead. I'm generally happier for it, since life tends to be simpler when my package manager of choice knows about any required libraries.