PT-2024-13749 · Go-Git+4 · Go-Git+4
Bdilalu
+1
·
Published
2023-11-27
·
Updated
2026-03-12
·
CVE-2023-49569
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
go-git versions prior to v5.11
Description
A path traversal vulnerability was discovered in go-git, allowing an attacker to create and amend files across the filesystem. In the worst-case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS, which is the default when using "Plain" versions of Open and Clone functions. Applications using BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
Recommendations
For versions prior to v5.11, upgrade to v5.11 to mitigate this vulnerability.
As a temporary workaround, consider limiting the use of go-git to only trustworthy Git servers.
Restrict access to the ChrootOS to minimize the risk of exploitation.
Avoid using the "Plain" versions of Open and Clone functions until the issue is resolved.
Fix
RCE
DoS
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Red Os
Ubuntu
Go-Git