CVE-2023-49569 (Critical) detected in github.com/go-git/go-git/v5-v5.4.2

[mend-for-github-com]

CVE-2023-49569 - Critical Severity Vulnerability

Vulnerable Library - github.com/go-git/go-git/v5-v5.4.2

A highly extensible Git implementation in pure Go.

Library home page: https://proxy.golang.org/github.com/go-git/go-git/v5/@v/v5.4.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/go-git/go-git/v5/@v/v5.4.2.mod

Dependency Hierarchy:

• ❌ github.com/go-git/go-git/v5-v5.4.2 (Vulnerable Library)

Found in base branch: improbable

Vulnerability Details

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.

Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue.
This is a go-git implementation issue and does not affect the upstream git cli.

Publish Date: 2024-01-12

URL: CVE-2023-49569

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-449p-3h89-pw88

Release Date: 2024-01-12

Fix Resolution: v5.11.0

---

• Check this box to open an automated fix PR