{"id":"CVE-2024-32478","summary":"Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files","details":"Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.\n","aliases":["GHSA-3c3g-h9rx-f7vq"],"modified":"2026-10-22T10:34:08.045720428Z","published":"2024-04-19T14:37:57.617Z","database_specific":{"cwe_ids":["CWE-732"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32478.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32478.json"},{"type":"ADVISORY","url":"https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-3c3g-h9rx-f7vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32478"},{"type":"FIX","url":"https://github.com/git-ecosystem/git-credential-manager/commit/d9ac33c5b1478383672b4425f5ecf875a62efba9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/git-ecosystem/git-credential-manager","events":[{"introduced":"0"},{"fixed":"d34930736e131ad80e5690e5634ced1808aff3e2"},{"fixed":"d9ac33c5b1478383672b4425f5ecf875a62efba9"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2.5.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"d9ac33c5b1478383672b4425f5ecf875a62efba9"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.2","v2.2.1","v2.2.0","v2.1.2","v2.1.1","v2.1.0","v2.0.935","v2.0.931","v2.0.886","v2.0.877","v2.0.866","v2.0.785","v2.0.779","v2.0.696","v2.0.692","v2.0.632","v2.0.605","v2.0.603","v2.0.567","v2.0.498","v2.0.475","v2.0.474","v2.0.472","v2.0.452","v2.0.435-beta","v2.0.394-beta","v2.0.374-beta","v2.0.318-beta","v2.0.289-beta","v2.0.280-beta","v2.0.252-beta","v2.0.249-beta","v2.0.246-beta","v2.0.194-beta","v2.0.164-beta","v2.0.157-beta","v2.0.153-beta","v2.0.124-beta","v2.0.87-beta","v2.0.79-beta","v2.0.33-beta","v2.0.22-beta","v2.0.5-beta"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-32478.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N"}]}