PT-2024-13749 · Go-Git +1 · Go-Git +1

Bdilalu

+1

·

Published

2024-01-10

·

Updated

2025-04-09

·

CVE-2023-49569

Report an issue
CVSS v3.1
9.8
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

go-git versions prior to v5.11

Description:

A path traversal vulnerability was discovered in go-git, allowing an attacker to create and amend files across the filesystem. In the worst-case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS, which is the default when using "Plain" versions of Open and Clone functions. Applications using BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

Recommendations:

For versions prior to v5.11, upgrade to v5.11 to mitigate this vulnerability.

As a temporary workaround, consider limiting the use of go-git to only trustworthy Git servers.

Restrict access to the ChrootOS to minimize the risk of exploitation.

Avoid using the "Plain" versions of Open and Clone functions until the issue is resolved.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-49569
GHSA-449P-3H89-PW88
GO-2024-2456
RHSA-2024:0880
RHSA-2024:2631
RHSA-2024:3925
RHSA-2024:4118

Affected Products

Debian
Go-Git