All the vulnerabilites related to go-git - go-git
cve-2023-49568
Vulnerability from cvelistv5
Published
2024-01-12 10:36
Modified
2024-08-02 22:01
Severity
Summary
Maliciously crafted Git server replies can cause DoS on go-git clients
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:01:25.669Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "go-git",
"vendor": "go-git",
"versions": [
{
"status": "affected",
"version": "5.11.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ionu\u021b Lalu"
}
],
"datePublic": "2024-01-12T10:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA denial of service (DoS) vulnerability was discovered in go-git versions prior to \u003ccode\u003ev5.11\u003c/code\u003e. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in \u003ccode\u003ego-git\u003c/code\u003e\u0026nbsp;clients.\u003c/p\u003e\u003cp\u003eApplications using only the in-memory filesystem supported by \u003ccode\u003ego-git\u003c/code\u003e\u0026nbsp;are not affected by this vulnerability.\u003cbr\u003eThis is a \u003ccode\u003ego-git\u003c/code\u003e\u0026nbsp;implementation issue and does not affect the upstream \u003ccode\u003egit\u003c/code\u003e\u0026nbsp;cli.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git\u00a0clients.\n\nApplications using only the in-memory filesystem supported by go-git\u00a0are not affected by this vulnerability.\nThis is a go-git\u00a0implementation issue and does not affect the upstream git\u00a0cli.\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-12T10:36:12.727Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An upgrade to v. 5.11 fixes this issue\u003cbr\u003e"
}
],
"value": "An upgrade to v. 5.11 fixes this issue\n"
}
],
"source": {
"advisory": "GHSA-mw99-9chc-xw7r",
"discovery": "EXTERNAL"
},
"title": "Maliciously crafted Git server replies can cause DoS on go-git clients",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2023-49568",
"datePublished": "2024-01-12T10:36:12.727Z",
"dateReserved": "2023-11-27T14:21:51.157Z",
"dateUpdated": "2024-08-02T22:01:25.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-49569
Vulnerability from cvelistv5
Published
2024-01-12 10:41
Modified
2024-08-02 22:01
Severity
Summary
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:01:25.499Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "go-git",
"vendor": "go-git",
"versions": [
{
"status": "affected",
"version": "5.11.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ionu\u021b Lalu"
}
],
"datePublic": "2024-01-12T10:40:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA path traversal vulnerability was discovered in go-git versions prior to \u003ccode\u003ev5.11\u003c/code\u003e. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.\u003c/p\u003e\u003cp\u003eApplications are only affected if they are using the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS\"\u003eChrootOS\u003c/a\u003e, which is the default when using \"Plain\" versions of Open and Clone funcs (e.g. PlainClone). Applications using \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS\"\u003eBoundOS\u003c/a\u003e\u0026nbsp;or in-memory filesystems are not affected by this issue.\u003cbr\u003eThis is a \u003ccode\u003ego-git\u003c/code\u003e\u0026nbsp;implementation issue and does not affect the upstream \u003ccode\u003egit\u003c/code\u003e\u0026nbsp;cli.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.\n\nApplications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using \"Plain\" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS \u00a0or in-memory filesystems are not affected by this issue.\nThis is a go-git\u00a0implementation issue and does not affect the upstream git\u00a0cli.\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-12T10:41:00.201Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An update to version 5.11 fixes the issue"
}
],
"value": "An update to version 5.11 fixes the issue"
}
],
"source": {
"advisory": "GHSA-449p-3h89-pw88",
"discovery": "EXTERNAL"
},
"title": "Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2023-49569",
"datePublished": "2024-01-12T10:41:00.201Z",
"dateReserved": "2023-11-27T14:21:51.157Z",
"dateUpdated": "2024-08-02T22:01:25.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}