PT-2026-29156 · Go-Git+1 · Go-Git+1
CVSS v3.1
2.8
Baixa
| Vetor | AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
go-git versions prior to 5.17.1
Description
The
go-git library’s index decoder for Git index format version 4 does not properly validate the path name prefix length before applying it to the previously decoded path name. A specially crafted index file can cause an out-of-bounds slice operation, leading to a runtime panic during index parsing. This issue only affects Git index format version 4. An attacker with the ability to modify or inject a Git index file within a local repository can cause applications using go-git to terminate, resulting in a denial-of-service (DoS) condition.Recommendations
Upgrade to version 5.17.1, or the latest version 6.
Exploit
Correção
DoS
Improper Validation of Array Index
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Os
Go-Git