CVE-2023-49569

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-49569

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49569.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-49569

Aliases

Related

Published

2024-01-12T11:15:13Z

Modified

2024-09-18T03:24:15.449767Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.

Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

References

Affected packages

Debian:12 / golang-github-go-git-go-git

Package

Name: golang-github-go-git-go-git
Purl: pkg:deb/debian/golang-github-go-git-go-git?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.4.2-3

5.4.2-4

5.11.0-1

5.11.0-2

5.11.0-3

5.11.0-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / golang-github-go-git-go-git