Code Execution on Git update in github.com/hashicorp/go-getter

Overview

Source
ID
GO-2024-2948
Aliases
CVE-2024-6257
GHSA-xfhp-jf8p-mh5w

Description

A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

Summary

5.50k
Total packages affected
Packages with at least one version that is affected by the advisory or has an affected dependency.
932
Packages with a known fix
Packages with versions affected by the advisory that have a greater version that is not affected.
0.41%
Total ecosystem affected
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0, Fixed: 1.7.5
Patched/Unaffected
v1.7.5
v1.7.6
v1.7.7
v1.7.8
Affected
v1.7.4
v1.7.3
v1.7.2
v1.7.1
v1.7.0
v1.6.2
v1.6.1
v1.6.0
v1.5.11
v1.5.10
v1.5.9
v1.5.8
v1.5.7
v1.5.6
v1.5.5
v1.5.4
v1.5.3
v1.5.2
v1.5.1
v1.5.0
v1.4.2
v1.4.1
v1.4.0
v1.3.0
v1.2.0
v1.1.0
v1.0.3
v1.0.2
v1.0.1
v1.0.0