A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.
Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue.
This is a go-git implementation issue and does not affect the upstream git cli.
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability.
This is a go-git implementation issue and does not affect the upstream git cli.
Project has been moved to: https://github.com/go-git/go-git
Library home page: https://proxy.golang.org/gopkg.in/src-d/go-git.v4/@v/v4.13.1.zip
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-49569
### Vulnerable Library - gopkg.in/src-d/go-git.v4-v4.13.1Project has been moved to: https://github.com/go-git/go-git
Library home page: https://proxy.golang.org/gopkg.in/src-d/go-git.v4/@v/v4.13.1.zip
Dependency Hierarchy: - :x: **gopkg.in/src-d/go-git.v4-v4.13.1** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsA path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
Publish Date: 2024-01-12
URL: CVE-2023-49569
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88
Release Date: 2024-01-12
Fix Resolution: v5.11.0
CVE-2023-49568
### Vulnerable Library - gopkg.in/src-d/go-git.v4-v4.13.1Project has been moved to: https://github.com/go-git/go-git
Library home page: https://proxy.golang.org/gopkg.in/src-d/go-git.v4/@v/v4.13.1.zip
Dependency Hierarchy: - :x: **gopkg.in/src-d/go-git.v4-v4.13.1** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsA denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.
Publish Date: 2024-01-12
URL: CVE-2023-49568
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88
Release Date: 2024-01-12
Fix Resolution: v5.11.0