CVE-2023-49569

EUVD-2024-0238

12.01.2024, 11:15

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.

Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue.
This is a go-git implementation issue and does not affect the upstream git cli.

Path Traversal

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 71%

Affected Products (NVD)

Vendor	Product	Version
go-git_project	go-git	4.0.0 ≤ 𝑥 < 5.11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

golang-github-go-git-go-git

bookworm	no-dsa
sid	5.12.0-1 fixed
trixie	5.12.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

golang-github-go-git-go-git

bionic	ignored
focal	dne
jammy	needs-triage
lunar	ignored
mantic	ignored
noble	needs-triage
oracular	needs-triage
trusty	ignored
xenial	ignored

Amazon Linux Releases

Amazon Package

Release

amazon-ssm-agent

Amazon Linux 1	0:3.2.2222.0-1.amzn1 fixed
Amazon Linux 2	0:3.2.2222.0-1.amzn2 fixed
Amazon Linux 2023	0:3.2.2222.0-1.amzn2023 fixed

amazon-ssm-agent-debuginfo

Amazon Linux 1	0:3.2.2222.0-1.amzn1 fixed
Amazon Linux 2	0:3.2.2222.0-1.amzn2 fixed
Amazon Linux 2023	0:3.2.2222.0-1.amzn2023 fixed

amazon-ssm-agent-debugsource

Amazon Linux 2023

0:3.2.2222.0-1.amzn2023

fixed

Azure Linux Releases

Azure Package

Release

cri-o

CBL-Mariner 2.0

0:1.22.3-12.cm2

fixed

packer

Azure Linux 3.0	0:1.9.5-1.azl3 fixed
CBL-Mariner 2.0	0:1.9.5-3.cm2 fixed

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88