Same for debian 11 bullseye, which is today on git 2.30.2 . I'm not too worried, if someone besides me manages to create a /home/.git, then I'm already owned. But it's a bit surprising.
However, you can use bullseye-backports to get 2.34.1 if you want: See https://packages.debian.org/git
Edit: None of the debian versions have the patch yet: https://security-tracker.debian.org/tracker/CVE-2022-24765