VYPR
← All advisories
Critical severityNVD Advisory· Published Jan 12, 2024· Updated Nov 14, 2024

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

CVE-2023-49569

Description

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.

Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/go-git/go-git/v5Go
>= 5.0.0, < 5.11.05.11.0
gopkg.in/src-d/go-git.v4Go
>= 4.0.0, <= 4.13.1—

Affected products

30

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.