| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/go-git/go-git/v4 | ≥ 4.0.0 | |
| github.com/go-git/go-git/v5 | < 5.13.0 | 5.13.0 |
| gopkg.in/src-d/go-git.v4 | ≥ 4.0.0, ≤ 4.13.1≥ 4.0.0 | |
| go-git | < 5.13.0 | 5.13.0 |
An argument injection vulnerability was discovered in go-git versions prior to v5.13.
Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries.
Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
In cases where a bump to the latest version of go-git is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.
Thanks to @vin01 for responsibly disclosing this vulnerability to us.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン