go-git v5/v6 Path Traversal Vulnerability Fix (GHSA-qqq7-7hm3-q3q8)

Vulnerability Overview Vulnerability Name: Malicious reference names may modify files outside the reference storage Vulnerability ID: GHSA-qqq7-7hm3-q3q8 Severity: Moderate (6.3 / 10) Publication Date: Last week Scope of Impact Affected Versions: - (Go) <= 5.19.1 - (Go) <= 6.0.0-alpha.4 Impact Description: - A path traversal vulnerability allows malicious reference names to access files outside the expected reference storage for the repository. - The vulnerability exists in the package and its reference storage implementation. - Users relying solely on the in-memory storage implementation ( ) are unaffected, as reference names are not treated as filesystem paths. - Exploitation requires the application to use with filesystem storage and interact with a malicious Git server or another method to control the reference names. Remediation Patched Versions: - (Go) 5.19.2 - (Go) 6.0.0-alpha.5 Fix Details: - Reference names are validated at the entry points of the storage, rejecting any names that resolve to paths potentially outside the reference storage. - Users employing filesystem storage should upgrade to the patched versions. Temporary Workarounds Applications using only are unaffected and do not require temporary workarounds. Applications using filesystem storage should avoid cloning or fetching from untrusted Git servers until they upgrade to the patched versions. Applications that directly construct or handle reference names can validate them before passing them to the storage. Application-level validation should only be considered a temporary workaround and does not replace upgrading to the patched version. References Fixes: - #2947 - #2954 Acknowledgments Thanks to @Saku012 for reporting this issue and @Sahana2524 for proposing the initial fix.

Goal Reached Thanks to every supporter — we hit 100%!

go-git v5/v6 Path Traversal Vulnerability Fix (GHSA-qqq7-7hm3-q3q8)

More from this source