CVE-2023-49568 json
Maliciously crafted Git server replies can cause DoS on go-git clients
published 2023-12-27 2 y ago modified 2026-09-10 1 mo ago also GHSA-mw99-9chc-xw7r , GO-2024-2466 , EUVD-2023-3251
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.
Patch / fix
- go github.com/go-git/go-git/v5 5.11.0
- go-git_project go-git 5.11.0
- golang-github-go-git-go-git Debian 14, Debian 13 5.11.0-1
debian advisories DEBIAN-CVE-2023-49568
- golang-github-go-git-go-git Ubuntu Pro 22.04 LTS 5.4.2-3ubuntu0.1~esm1
- golang-github-go-git-go-git Ubuntu Pro 24.04 LTS 5.4.2-4ubuntu0.24.04.3+esm2
ubuntu advisories UBUNTU-CVE-2023-49568
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openshift-serverless-clients serverless 1.0 1.10.0-6.el8
- ceph ceph storage 7.1 2:18.2.1-194.el8cp
- ceph ceph storage 7.1 2:18.2.1-194.el9cp
- thrift ceph storage 7.1 0.13.0-2.el8cp
- cephadm ceph storage 7.1 2:18.2.1-194.el9cp
- liboath ceph storage 7.1 2.6.2-3.el8cp
- librbd1 ceph storage 7.1 2:18.2.1-194.el8cp
- librbd1 ceph storage 7.1 2:18.2.1-194.el9cp
red hat advisories RHSA-2024:0880RHSA-2024:3925
- nfpm Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 2.35.2-r0
alpine advisories ALPINE-CVE-2023-49568
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- packer CBL-Mariner 2.0 1.9.5-3
- packer Azure Linux 3.0 1.9.5-1
- cri-o CBL-Mariner 2.0 1.22.3-12
azure linux advisories AZL-33892AZL-35095AZL-39595
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-49568 updated cvss 7.5
go-git: Maliciously crafted Git server replies can cause DoS on go-git clients
-
Red Hat OpenShift Developer Tools and Services odoaffected: workaround, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat Advanced Cluster Management for Kubernetes 2 multicluster-engine, multicluster-globalhub-grafana, rhacm2/submariner-rhel8-operator, multicluster-engine-assisted-service, multicluster-engine-assisted-installer-reporteraffected: workaround, no fix available, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, +2 moreaffected: workaround, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9affected: workaround, no fix available “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat OpenShift Container Platform 4 openshift-clients, openshift4/ose-cli, openshift4/ose-console, openshift4/ose-deployer, openshift4/ose-cli-artifacts, openshift4/ose-ansible-operator, +2 moreaffected: workaround, no fix available, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, rhods/odh-ml-pipelines-artifact-manager-rhel8, rhods/odh-ml-pipelines-persistenceagent-rhel8, rhods/odh-ml-pipelines-viewercontroller-rhel8, rhods/odh-ml-pipelines-scheduledworkflow-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cluster-network-addons-operator-rhel9affected: workaround, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-ovn-kubernetes-rhel9under investigation
-
Red Hat Builds for Red Hat OpenShift 1.0 openshift-builds/openshift-builds-waiters-rhel8 v1.0.1-4, openshift-builds/openshift-builds-webhook-rhel8 v1.0.1-4, openshift-builds/openshift-builds-rhel8-operator v1.0.1-6, openshift-builds/openshift-builds-controller-rhel8 v1.0.1-4, openshift-builds/openshift-builds-git-cloner-rhel8 v1.0.1-4, openshift-builds/openshift-builds-operator-bundle v1.0.1-11, +2 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1557
show 13 moreshow fewer
-
Red Hat multicluster-globalhub 1.0 for RHEL 8 multicluster-globalhub/multicluster-globalhub-grafana-rhel8 v1.0.2-4fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0989
-
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/multicluster-operators-subscription-rhel8 v2.9.2-2fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0298
-
Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-194.el8cp, ceph 18.2.1-194.el9cp, cephadm 18.2.1-194.el9cp, librbd1 18.2.1-194.el8cp, librbd1 18.2.1-194.el9cp, librgw2 18.2.1-194.el8cp, +37 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:3925
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-helm-operator v4.12.0-202402081808.p0.g0bd975e.assembly.stream.el8, openshift4/ose-ansible-operator v4.12.0-202402081808.p0.g0bd975e.assembly.stream.el8, openshift4/ose-olm-rukpak-rhel8 v4.12.0-202402161937.p0.gf219ce7.assembly.stream.el8, openshift4/ose-operator-registry v4.12.0-202402111607.p0.g9dd28b4.assembly.stream.el8, openshift4/oc-mirror-plugin-rhel8 v4.12.0-202404171248.p0.g3f39dc6.assembly.stream.el8, openshift4/ose-operator-sdk-rhel8 v4.12.0-202402081808.p0.g0bd975e.assembly.stream.el8, +1 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1896
-
Red Hat OpenShift Container Platform 4.13 openshift4/ose-helm-operator v4.13.0-202402020908.p0.g01bfabb.assembly.stream, openshift4/ose-ansible-operator v4.13.0-202402020908.p0.g01bfabb.assembly.stream, openshift4/ose-olm-rukpak-rhel8 v4.13.0-202402070238.p0.gaf47118.assembly.stream.el8, openshift4/ose-operator-registry v4.13.0-202402081808.p0.g4cc5232.assembly.stream.el8, openshift4/oc-mirror-plugin-rhel8 v4.13.0-202404200313.p0.g02367d7.assembly.stream.el8, openshift4/ose-operator-sdk-rhel8 v4.13.0-202402071637.p0.g01bfabb.assembly.stream.el8, +1 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:2047
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-helm-operator v4.14.0-202401301709.p0.g0f0d1b2.assembly.stream, openshift4/ose-tools-rhel8 v4.14.0-202406180839.p0.gaa6e2f2.assembly.stream.el8, openshift4/ose-ansible-operator v4.14.0-202401301709.p0.g0f0d1b2.assembly.stream, openshift4/ose-olm-rukpak-rhel8 v4.14.0-202402060410.p0.g2287fb2.assembly.stream, openshift4/ose-operator-registry v4.14.0-202402010409.p0.gb831504.assembly.stream, openshift4/ose-olm-catalogd-rhel8 v4.14.0-202401292111.p0.ga333cb0.assembly.stream, +4 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1891
-
Red Hat OpenShift Container Platform 4.15 openshift4/ose-tools-rhel8 v4.15.0-202406101406.p0.g44edfb5.assembly.stream.el8, openshift4/oc-mirror-plugin-rhel9 v4.15.0-202404161612.p0.g85c8f6f.assembly.stream.el9fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:3889
-
Red Hat OpenShift GitOps 1.9 openshift-gitops-1/dex-rhel8 v1.9.4-1, openshift-gitops-1/argocd-rhel8 v1.9.4-1, openshift-gitops-1/gitops-rhel8 v1.9.4-1, openshift-gitops-1/must-gather-rhel8 v1.9.4-1, openshift-gitops-1/kam-delivery-rhel8 v1.9.4-1, openshift-gitops-1/argo-rollouts-rhel8 v1.9.4-1, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0691
-
Red Hat OpenShift GitOps 1.10 openshift-gitops-1/dex-rhel8 v1.10.2-2, openshift-gitops-1/argocd-rhel8 v1.10.2-2, openshift-gitops-1/gitops-rhel8 v1.10.2-2, openshift-gitops-1/must-gather-rhel8 v1.10.2-2, openshift-gitops-1/kam-delivery-rhel8 v1.10.2-2, openshift-gitops-1/argo-rollouts-rhel8 v1.10.2-2, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0692
-
Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.10.0-6.el8fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0880
-
Red Hat OpenShift Serverless 1.31 openshift-serverless-1/client-kn-rhel8 1.10.0-5, openshift-serverless-1/func-utils-rhel8 1.31.1-2, openshift-serverless-1/serving-queue-rhel8 1.10.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.10.0-4, openshift-serverless-1/kourier-control-rhel8 1.10.0-4, openshift-serverless-1/serving-webhook-rhel8 1.10.0-4, +34 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0843
-
Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.0-17, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.0-9, advanced-cluster-security/rhacs-rhel8-operator 4.4.0-9, advanced-cluster-security/rhacs-scanner-rhel8 4.4.0-11, advanced-cluster-security/rhacs-central-db-rhel8 4.4.0-9, advanced-cluster-security/rhacs-scanner-db-rhel8 4.4.0-11, +2 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1570
-
Red Hat multicluster-globalhub 1.0 for RHEL 8 multicluster-globalhub/multicluster-globalhub-agent-rhel8 v1.0.2-4, multicluster-globalhub/multicluster-globalhub-manager-rhel8 v1.0.2-4, multicluster-globalhub/multicluster-globalhub-rhel8-operator v1.0.2-4, multicluster-globalhub/multicluster-globalhub-operator-bundle v1.0.2-8 Red Hat Advanced Cluster Management for Kubernetes 2 hub-of-hubs-gitops, rhacm2/openshift-hive-rhel8, rhacm2/search-collector-rhel9, rhacm2/cluster-curator-controller-rhel8, rhacm2/endpoint-monitoring-rhel9-operator, rhacm2/clusterlifecycle-state-metrics-rhel8, +3 more Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/thanos-rhel8 v2.9.2-1, rhacm2/console-rhel8 v2.9.2-2, rhacm2/memcached-rhel8 v2.9.2-1, rhacm2/prometheus-rhel8 v2.9.2-1, rhacm2/acm-grafana-rhel8 v2.9.2-1, rhacm2/acm-operator-bundle v2.9.2-4, +37 more Red Hat Ceph Storage 7.1 Tools liboath 2.6.2-3.el8cp, thrift 0.13.0-2.el8cp, gperftools 2.7-9.el8cp, libunwind 1.3.1-3.el8cp, oath-toolkit 2.6.2-3.el8cp, gperftools-libs 2.7-9.el8cp, +1 more Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinuxnot affected: vulnerable code not present
+9 more productsfewer
Red Hat OpenShift Container Platform 4 cri-o Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202402131748-0, rhcos 412.86.202402272018-0, rhcos 412.86.202404162110-0, openshift4/ose-cli v4.12.0-202402081808.p0.gd4c9e3c.assembly.stream.el8, openshift4/ose-cli v4.12.0-202404170201.p0.gd691257.assembly.stream.el8, openshift4/ose-pod v4.12.0-202402081808.p0.g6df2177.assembly.stream.el8, +428 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202402060605-0, rhcos 413.92.202402131523-0, rhcos 413.92.202404232117-0, openshift4/ose-cli v4.13.0-202402011837.p0.g7780c37.assembly.stream, openshift4/ose-pod v4.13.0-202402060538.p0.g8f85140.assembly.stream, openshift4/ose-ptp v4.13.0-202402011837.p0.gc279a05.assembly.stream, +575 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202402010350-0, rhcos 414.92.202406190006-0, openshift4/ose-cli v4.14.0-202401292111.p0.g286cfa5.assembly.stream, openshift4/ose-pod v4.14.0-202401292111.p0.g28ed2d7.assembly.stream, openshift4/frr-rhel9 v4.14.0-202401302240.p0.g0414ca3.assembly.stream, openshift4/ose-tests v4.14.0-202401292111.p0.gc35d76d.assembly.stream, +658 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202404161628-0, rhcos 415.92.202406111137-0, openshift4/ose-cli v4.15.0-202404151834.p0.g62c4d45.assembly.stream.el8, openshift4/ose-cli v4.15.0-202406101406.p0.g44edfb5.assembly.stream.el8, openshift4/ose-tests v4.15.0-202404151834.p0.g8fe25d7.assembly.stream.el8, openshift4/ose-tests v4.15.0-202406101406.p0.gc13a01e.assembly.stream.el8, +334 more Red Hat Openshift Data Foundation 4 odf4/odr-rhel9-operator, odf4/odf-csi-addons-sidecar-rhel8, odf4/odf-csi-addons-rhel8-operator Red Hat OpenShift Dev Spaces devspaces/devspaces-rhel8-operator Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, osp-director-provisioner-container, rhosp-rhel8-tech-preview/osp-director-operator, rhosp-rhel8-tech-preview/osp-director-downloader Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-collector-rhel8 4.4.0-2, advanced-cluster-security/rhacs-operator-bundle 4.4.0-17, advanced-cluster-security/rhacs-scanner-v4-rhel8 4.4.0-13, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 4.4.0-8, advanced-cluster-security/rhacs-collector-slim-rhel8 4.4.0-2
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/go-git/go-git/v5 | <5.11.0 >=5.0.0, <5.11.0 |
5.11.0 |
| go | gopkg.in/src-d/go-git.v4 | >=4.7.1, <=4.13.1 >=4.7.1 |
no fix listed |
Affected products
- go-git go-git
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49568
advisory
-
github.com
/go-git/go-git
package
Sources
- CVE List CVE-2023-49568
- GitHub Advisory GHSA-mw99-9chc-xw7r
- NVD CVE-2023-49568
- OSV GO-2024-2466
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.