Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
CVE: CVE-2023-49569
Component: go-git
CWE: CWE-22
Severity: Critical
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A path traversal vulnerability was discovered in the go library go-git. This issue may allow an attacker to create and amend files across the filesystem when applications are using the default ChrootOS, potentially allowing remote code execution.

Statement: This problem only affects the go implementation and not the original git cli code. Applications using BoundOS or in-memory filesystems are not affected by this issue. Clients should be limited to connect to only trusted git servers to reduce the risk of compromise.

In OpenShift Container Platform (OCP) the vulnerable github.com/go-git/go-git/v5 Go package is used as a dependency in many components where the vulnerable function is not used, hence the impact by this vulnerability is reduced to Low.

In Openshift-Clients, the affected github.com/go-git/go-git/v5 is a transitive dependency and Openshift-Clients do not use the affected codebase of the go-git package. Hence, it is marked as Not Affected.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
See the Red Hat OpenShift serverless documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.31
For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/install/index#installing
If you are using an earlier version of RHACS 4.3, you are advised to upgrade to patch release 4.3.6.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7446b0c3cc24c6d35c0d0fc968ef27f52da92c60f41951c0e646041db108169a

      (For s390x architecture)
      The image digest is sha256:0297188ad2936833b6b1377ca35276277d86fd614dfed8209fb1c06ccea4087d

      (For ppc64le architecture)
      The image digest is sha256:7c6bca201a245b790a2d122fb0e0717db2c9c95a2aa505e2db6fa3b16218e00b

      (For aarch64 architecture)
      The image digest is sha256:c8e7b64a4fa1145eeac395b4895fb60524f71f22eaffee0f69fd70e25b3bab16

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:158ced797e49f6caf7862acccef58484be63b642fdd2f66e6416295fa7958ab0

(For s390x architecture)
The image digest is sha256:0dc967d680e06ba58c2e30f3729fd4dd0274603b1e5e717172bb06ba1977aa9e

(For ppc64le architecture)
The image digest is sha256:485e2734d2f926af79f555c24fd622dd2c9765e830e088a1b843c2534dedbce8

(For aarch64 architecture)
The image digest is sha256:84ee8f7f61a0b2ee67e83e98ed48ad6e2584253fba44047716d042a8a90ff4c2

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:a9d7e4938d224a6a8f9c7a5c05ca2b4d6e92292812b14c4a3e0d9e938e8dc3bf

      (For s390x architecture)
      The image digest is sha256:d2b27993318e4e72388bcc8a4ba655810e903f0e6bdcb444648e8d0488646816

      (For ppc64le architecture)
      The image digest is sha256:9d42788d7b8ad829c43ff536471b7245745ed86d6285f39a5c8050541bc52b85

      (For aarch64 architecture)
      The image digest is sha256:192059898431ff5af6b60d4e1f583ef32b4c59b08772a9f73c1735a812700f6b

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:dbb8aa0cf53dc5ac663514e259ad2768d8c82fd1fe7181a4cfb484e3ffdbd3ba

      (For s390x architecture)
      The image digest is sha256:421f1d408713576cd597aeabdeefb2cad6c6d4c1f40e0a88e9026911fb69aaaf

      (For ppc64le architecture)
      The image digest is sha256:00283cbb7dceb54be3bea4f7d2b7877eac7dadcd952f0e4b0c3d95cf761f03bb

      (For aarch64 architecture)
      The image digest is sha256:b6395664a18f7fe6ae8faf57a6be0490ffffa12b71dfa42e9515f91baa407a6f

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7083519fd75dc187b7405968ba3d3d764a9807529e955411fd0ca1142dd4b560
      (For s390x architecture)
      The image digest is sha256:fd12ce4b8e006c6d8613f32f36e5ca994aeef6dee158b7179c450af2b86de4b9

      (For ppc64le architecture)
      The image digest is sha256:d46a10358eb60f80a0d483aeba8c28d834769465a298ecb37dc69c7ab4cd92d9

      (For aarch64 architecture)
      The image digest is sha256:2e6962da6066332442fbd5d27b5917f3980bef59be6cabab263774ac615213db

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:04081f0cdc3a98eb9b705aceb86d4a035f7e6ccf6d9d10621776d53134f81c33

(For s390x architecture)
The image digest is sha256:ca025a3ba9de59089b7278263115bd54a4d7164e48b9fa856c6f3688f62dae82

(For ppc64le architecture)
The image digest is sha256:f42073e4296bd8e8dcf1b3ccf3a9a0213eac6039a1393d56bd34514606e09900

(For aarch64 architecture)
The image digest is sha256:64a6652bc3ee1eeaa4020ec7ea73e7484b398aa98144bcc4774cbb1358375027

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7093fa606debe63820671cc92a1384e14d0b70058d4b4719d666571e1fc62190

      (For s390x architecture)
      The image digest is sha256:784621b67af470153f02521237b8170fed3d58d31333b4b094cf30f6d657e40e

      (For ppc64le architecture)
      The image digest is sha256:6cedfcf05100b51d7dab8ac4c0ea8c06aac8989143a3d564daf5b8041120e3ae

      (For aarch64 architecture)
      The image digest is sha256:7c13402788d2e98964fa6e53b435b02b62d71769ce6c66fb4cf7d0116c7a33c6

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:36783a8b066c96dd6258e818ce51b5a763438adbf56221ea5c4b62ae4f345886

      (For s390x architecture)
      The image digest is sha256:ae44573838e7a212a5c1c770249862763cacc3dcc07cedca37a140a73ee8ab01

      (For ppc64le architecture)
      The image digest is sha256:6dc606eb76237e5fca46cf0ecc5665c473571b58c73b3e2ae48cda4f7eb62748

      (For aarch64 architecture)
      The image digest is sha256:a456939baf9762ce465d90a73aee8b1dc73c79321472aefb88496766eba5add7

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:671bc35e8fc2027d6f4c2c756d19909d83d55d1c591e8f9ea790ec8da744d171

      (For s390x architecture)
      The image digest is sha256:641ac9df3fbc2575922e68cc2e3b0903d7d268faf6862777fca93ac7ed2fe82b

      (For ppc64le architecture)
      The image digest is sha256:ab24f08a86cb6715e3259153ab44820620d80f21c87781001289bc7ebe13cf02

      (For aarch64 architecture)
      The image digest is sha256:7f3942d330660112a9220786bd2fb3015f05bda0354002f70cf5735e6386b93b

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:0da6316466d60a3a4535d5fed3589feb0391989982fba59d47d4c729912d6363

      (For s390x architecture)
      The image digest is sha256:8dd9ec7f5d7d7990cf66182960dc6bbf4815295f5b252e3ae3e38b5f0f65ace1

      (For ppc64le architecture)
      The image digest is sha256:26674d2dad3e80fe0e34af948bba02f5ea93ae505180e3224177b913049103ba

      (For aarch64 architecture)
      The image digest is sha256:41d64cadd215782ebdfb54706481c5b70f8551522377849945d353771fdfe51a

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
See the Red Hat OpenShift serverless 1.31 documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.31
See the multicluster global hub product documentation for more information:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/multicluster_global_hub/index
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

and

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:da7da5023f153df1417ead29ed0a6e0998c3016a4173ca1956cf05da918b6ccb

      (For s390x architecture)
      The image digest is sha256:e128f95fd4c5edb0fd632f21a9536a0d83ee160abc3c207209e63811db61f1b5

      (For ppc64le architecture)
      The image digest is sha256:b28ec45481140342793dec40424d8c775f6cceabc626b1591f62da8eea206648

      (For aarch64 architecture)
      The image digest is sha256:4a2cb3e13cdf9d41c5514355c8596e61883b4870b89876f906d5ec44653138be

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:3717338045df06e31effea46761b2c7e90f543cc4f00547af8158dd6aea868c3

      (For s390x architecture)
      The image digest is sha256:f02384fd3022a53fa24e142c3d8eb51547f566611a9dd560d5bfeabab1e578da

      (For ppc64le architecture)
      The image digest is sha256:500926479acad10193dbf6ea3944e23b92ff004bcf7bfb7e85728f1b8cffe2b2

      (For aarch64 architecture)
      The image digest is sha256:817126345d1ee68397634303571632c5cc8938cd4d59f940803ab38d8e6799e3

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
Red Hat OpenShift Builds Release
Red Hat OpenShift Builds Release
In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.