GHSA-xfhp-jf8p-mh5w
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
Quick fix
GHSA-xfhp-jf8p-mh5w — github.com/hashicorp/go-getter: upgrade to the fixed version with the command below.
go get github.com/hashicorp/go-getter@v1.7.5Details
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .
An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 1.7.5go get github.com/hashicorp/go-getter@v1.7.5References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6257[ADVISORY]
- https://github.com/hashicorp/go-getter/commit/268c11cae8cf0d9374783e06572679796abe9ce9[WEB]
- https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081[WEB]
- https://github.com/advisories/GHSA-xfhp-jf8p-mh5w[ADVISORY]
- https://github.com/hashicorp/go-getter[PACKAGE]