| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/go-getter | < 1.7.5 | 1.7.5 |
| go-getter | < 1.7.5 | 1.7.5 |
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .
An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free