Code Execution on Git update in github.com/hashicorp/go-getter
Overview
Source
ID
GO-2024-2948
Aliases
CVE-2024-6257
GHSA-xfhp-jf8p-mh5w
Affected package
Description
A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Impact
Reference links
Summary
5.50k
Total packages affected
help_outline
Packages with at least one version that is affected by the advisory or has an affected dependency.
932
Packages with a known fix
help_outline
Packages with versions affected by the advisory that have a greater version that is not affected.
0.41%
Total ecosystem affected
help_outline
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0, Fixed: 1.7.5
Affected