CVE-2023-49569
Assigner: Bitdefender
Published: 2024-01-12T10:41:00.201Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: go-git
vendor: go-git
versions: status: affected
version: 5.11.0
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Ionuț Lalu
datePublic: 2024-01-12T10:40:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p>A path traversal vulnerability was discovered in go-git versions prior to <code>v5.11</code>. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.</p><p>Applications are only affected if they are using the <a target="_blank" rel="nofollow" href="https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS">ChrootOS</a>, which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using <a target="_blank" rel="nofollow" href="https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS">BoundOS</a>&nbsp;or in-memory filesystems are not affected by this issue.<br>This is a <code>go-git</code>&nbsp;implementation issue and does not affect the upstream <code>git</code>&nbsp;cli.</p><br>
value: A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.

Applications are only affected if they are using the  ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using  BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue.
This is a go-git implementation issue and does not affect the upstream git cli.



impacts: capecId: CAPEC-126
descriptions: value: CAPEC-126 Path Traversal
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: An update to version 5.11 fixes the issue
value: An update to version 5.11 fixes the issue
source: advisory: GHSA-449p-3h89-pw88
discovery: EXTERNAL
title: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
x_generator: engine: Vulnogram 0.1.0-dev