CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49569 – Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
https://notcve.org/view.php?id=CVE-2023-49569
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli. • https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88 https://access.redhat.com/security/cve/CVE-2023-49569 https://bugzilla.redhat.com/show_bug.cgi?id=2258143 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49568 – Maliciously crafted Git server replies can cause DoS on go-git clients
https://notcve.org/view.php?id=CVE-2023-49568
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli. Se descubrió una vulnerabilidad de denegación de servicio (DoS) en versiones de go-git anteriores a la v5.11. Esta vulnerabilidad permite a un atacante realizar ataques de denegación de servicio proporcionando respuestas especialmente manipuladas desde un servidor Git que provoca el agotamiento de los recursos en los clientes go-git. Las aplicaciones que utilizan únicamente el sistema de archivos en memoria compatible con go-git no se ven afectadas por esta vulnerabilidad. • https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r https://access.redhat.com/security/cve/CVE-2023-49568 https://bugzilla.redhat.com/show_bug.cgi?id=2258165 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46402
https://notcve.org/view.php?id=CVE-2023-46402
git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. La versión 1.0.1 de git-urls es vulnerable a ReDOS (Denegación de servicio de expresión regular) en el paquete Go. • https://gist.github.com/6en6ar/7c2424c93e7fbf2b6fc44e7fb9acb95d • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-26134
https://notcve.org/view.php?id=CVE-2023-26134
Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content. • https://github.com/JPeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18c https://github.com/JPeer264/node-git-commit-info/issues/24 https://security.snyk.io/vuln/SNYK-JS-GITCOMMITINFO-5740174 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33290
https://notcve.org/view.php?id=CVE-2023-33290
The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python). • https://github.com/tjtelan/git-url-parse-rs/issues/51 https://lib.rs/crates/git-url-parse • CWE-1333: Inefficient Regular Expression Complexity •