Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

CVE-2023-49569

Summary

A path traversal vulnerability has been identified in go-git, affecting versions prior to v5.11. This security flaw enables attackers to traverse the filesystem, allowing unauthorized creation and modification of files, and in severe cases, may lead to remote code execution. Applications employing the ChrootOS functionality are susceptible when using 'Plain' versions of Open and Clone functions. However, those utilizing BoundOS or in-memory filesystems remain unaffected. It is important to note that this issue is isolated to the go-git implementation and does not impact the upstream git command-line interface.

References