critical
9.8
CVE-2023-49569 json
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
published 2024-01-10 2 y ago modified 2026-09-10 1 mo ago also GHSA-449p-3h89-pw88 , GO-2024-2456 , EUVD-2024-0238
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.
Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
Patch / fix
- go github.com/go-git/go-git/v5 5.11.0
- go-git_project go-git 5.11.0
- golang-github-go-git-go-git Debian 14, Debian 13 5.11.0-1
debian advisories DEBIAN-CVE-2023-49569
- golang-github-go-git-go-git Ubuntu Pro 22.04 LTS 5.4.2-3ubuntu0.1~esm1
- golang-github-go-git-go-git Ubuntu Pro 24.04 LTS 5.4.2-4ubuntu0.24.04.3+esm2
ubuntu advisories UBUNTU-CVE-2023-49569
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ceph ceph storage 5.3 2:16.2.10-266.el8cp
- ceph ceph storage 5.3 2:16.2.10-266.el9cp
- cephadm ceph storage 5.3 2:16.2.10-266.el8cp
- cephadm ceph storage 5.3 2:16.2.10-266.el9cp
- librbd1 ceph storage 5.3 2:16.2.10-266.el8cp
- librbd1 ceph storage 5.3 2:16.2.10-266.el9cp
- librgw2 ceph storage 5.3 2:16.2.10-266.el8cp
- librgw2 ceph storage 5.3 2:16.2.10-266.el9cp
red hat advisories RHSA-2024:4118RHSA-2024:0880RHSA-2024:3925RHSA-2024:2631
- packer CBL-Mariner 2.0 1.9.5-3
- packer Azure Linux 3.0 1.9.5-1
- cri-o CBL-Mariner 2.0 1.22.3-12
azure linux advisories AZL-33891AZL-35098AZL-39592
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-49569 updated cvss 8.1
go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
-
Red Hat OpenShift Developer Tools and Services odoaffected: workaround, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat Advanced Cluster Management for Kubernetes 2 multicluster-engine, multicluster-globalhub-grafana, multicluster-engine-assisted-service, multicluster-engine-assisted-installer-reporteraffected: workaround, no fix available, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, +2 more Red Hat OpenShift Container Platform 4 openshift4/ose-cli, openshift4/ose-console, openshift4/ose-deployer, openshift4/ose-tools-rhel9, openshift4/ose-cli-artifacts, openshift4/ose-cli-artifacts-alt-rhel8 Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, rhods/odh-ml-pipelines-artifact-manager-rhel8, rhods/odh-ml-pipelines-persistenceagent-rhel8, rhods/odh-ml-pipelines-viewercontroller-rhel8, rhods/odh-ml-pipelines-scheduledworkflow-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cluster-network-addons-operator-rhel9affected: workaround, no fix planned “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.”
-
Red Hat Builds for Red Hat OpenShiftfixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:6221
-
Red Hat Builds for Red Hat OpenShift 1.0 openshift-builds/openshift-builds-waiters-rhel8 v1.0.1-4, openshift-builds/openshift-builds-webhook-rhel8 v1.0.1-4, openshift-builds/openshift-builds-rhel8-operator v1.0.1-6, openshift-builds/openshift-builds-controller-rhel8 v1.0.1-4, openshift-builds/openshift-builds-git-cloner-rhel8 v1.0.1-4, openshift-builds/openshift-builds-operator-bundle v1.0.1-11, +2 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1557
-
Red Hat Builds for Red Hat OpenShift 1.1.1 openshift-buildsfixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:5013
-
Red Hat multicluster-globalhub 1.0 for RHEL 8 multicluster-globalhub/multicluster-globalhub-grafana-rhel8 v1.0.2-4fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0989
-
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/multicluster-operators-subscription-rhel8 v2.9.2-2fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0298
show 14 moreshow fewer
-
Red Hat Ceph Storage 5.3 MON ceph 16.2.10-266.el8cp, cephadm 16.2.10-266.el8cp, librbd1 16.2.10-266.el8cp, librgw2 16.2.10-266.el8cp, ceph-mgr 16.2.10-266.el8cp, ceph-mon 16.2.10-266.el8cp, +22 more Red Hat Ceph Storage 5.3 OSD ceph 16.2.10-266.el8cp, librbd1 16.2.10-266.el8cp, librgw2 16.2.10-266.el8cp, ceph-osd 16.2.10-266.el8cp, ceph-base 16.2.10-266.el8cp, ceph-test 16.2.10-266.el8cp, +12 more Red Hat Ceph Storage 5.3 Tools ceph 16.2.10-266.el8cp, ceph 16.2.10-266.el9cp, cephadm 16.2.10-266.el8cp, cephadm 16.2.10-266.el9cp, librbd1 16.2.10-266.el8cp, librbd1 16.2.10-266.el9cp, +44 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:4118
-
Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-rhel9 6-311, rhceph/keepalived-rhel9 2.2.8-11, rhceph/snmp-notifier-rhel9 1.2.1-57, rhceph/rhceph-6-dashboard-rhel9 6-90, rhceph/rhceph-haproxy-rhel9 2.4.22-12, rhceph/rhceph-promtail-rhel9 v2.4.0-19fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:2633
-
Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-194.el8cp, ceph 18.2.1-194.el9cp, cephadm 18.2.1-194.el9cp, librbd1 18.2.1-194.el8cp, librbd1 18.2.1-194.el9cp, librgw2 18.2.1-194.el8cp, +37 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:3925
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-helm-operator v4.12.0-202402081808.p0.g0bd975e.assembly.stream.el8, openshift4/ose-ansible-operator v4.12.0-202402081808.p0.g0bd975e.assembly.stream.el8, openshift4/ose-olm-rukpak-rhel8 v4.12.0-202402161937.p0.gf219ce7.assembly.stream.el8, openshift4/ose-operator-registry v4.12.0-202402111607.p0.g9dd28b4.assembly.stream.el8, openshift4/oc-mirror-plugin-rhel8 v4.12.0-202404171248.p0.g3f39dc6.assembly.stream.el8, openshift4/ose-operator-sdk-rhel8 v4.12.0-202402081808.p0.g0bd975e.assembly.stream.el8, +1 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1896
-
Red Hat OpenShift Container Platform 4.13 openshift4/ose-helm-operator v4.13.0-202402020908.p0.g01bfabb.assembly.stream, openshift4/ose-ansible-operator v4.13.0-202402020908.p0.g01bfabb.assembly.stream, openshift4/ose-olm-rukpak-rhel8 v4.13.0-202402070238.p0.gaf47118.assembly.stream.el8, openshift4/ose-operator-registry v4.13.0-202402081808.p0.g4cc5232.assembly.stream.el8, openshift4/oc-mirror-plugin-rhel8 v4.13.0-202404200313.p0.g02367d7.assembly.stream.el8, openshift4/ose-operator-sdk-rhel8 v4.13.0-202402071637.p0.g01bfabb.assembly.stream.el8, +1 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:2047
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-helm-operator v4.14.0-202401301709.p0.g0f0d1b2.assembly.stream, openshift4/ose-ansible-operator v4.14.0-202401301709.p0.g0f0d1b2.assembly.stream, openshift4/ose-olm-rukpak-rhel8 v4.14.0-202402060410.p0.g2287fb2.assembly.stream, openshift4/ose-operator-registry v4.14.0-202402010409.p0.gb831504.assembly.stream, openshift4/ose-olm-catalogd-rhel8 v4.14.0-202401292111.p0.ga333cb0.assembly.stream, openshift4/ose-operator-sdk-rhel8 v4.14.0-202401301709.p0.g0f0d1b2.assembly.stream, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1891
-
Red Hat OpenShift Container Platform 4.15 openshift4/ose-helm-operator v4.15.0-202402082307.p0.g08d08dd.assembly.stream.el8, openshift4/ose-ansible-operator v4.15.0-202402082307.p0.g08d08dd.assembly.stream.el8, openshift4/ose-olm-rukpak-rhel8 v4.15.0-202402082307.p0.g36acf8d.assembly.stream.el8, openshift4/oc-mirror-plugin-rhel9 v4.15.0-202410230304.p0.ge91f573.assembly.stream.el9, openshift4/ose-olm-catalogd-rhel8 v4.15.0-202402082307.p0.gc1a9a8e.assembly.stream.el8, openshift4/ose-operator-sdk-rhel8 v4.15.0-202402210637.p0.g08d08dd.assembly.stream.el8, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2023:7197
-
Red Hat OpenShift Container Platform 4.16 openshift4/ose-ansible-operator v4.16.0-202406130637.p0.g4194617.assembly.stream.el8, openshift4/ose-olm-rukpak-rhel9 v4.16.0-202406131906.p0.g282cc84.assembly.stream.el9, openshift4/oc-mirror-plugin-rhel9 v4.16.0-202406131906.p0.g7c0889f.assembly.stream.el9, openshift4/ose-olm-catalogd-rhel9 v4.16.0-202406131906.p0.g79975a5.assembly.stream.el9, openshift4/ose-operator-sdk-rhel9 v4.16.0-202406131906.p0.g4194617.assembly.stream.el9, openshift4/ose-helm-rhel9-operator v4.16.0-202406131906.p0.g4194617.assembly.stream.el9, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0040
-
Red Hat OpenShift GitOps 1.9 openshift-gitops-1/dex-rhel8 v1.9.4-1, openshift-gitops-1/argocd-rhel8 v1.9.4-1, openshift-gitops-1/gitops-rhel8 v1.9.4-1, openshift-gitops-1/must-gather-rhel8 v1.9.4-1, openshift-gitops-1/kam-delivery-rhel8 v1.9.4-1, openshift-gitops-1/argo-rollouts-rhel8 v1.9.4-1, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0691
-
Red Hat OpenShift GitOps 1.10 openshift-gitops-1/dex-rhel8 v1.10.2-2, openshift-gitops-1/argocd-rhel8 v1.10.2-2, openshift-gitops-1/gitops-rhel8 v1.10.2-2, openshift-gitops-1/must-gather-rhel8 v1.10.2-2, openshift-gitops-1/kam-delivery-rhel8 v1.10.2-2, openshift-gitops-1/argo-rollouts-rhel8 v1.10.2-2, +3 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0692
-
Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.10.0-6.el8fixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0880
-
Red Hat OpenShift Serverless 1.31 openshift-serverless-1/client-kn-rhel8 1.10.0-5, openshift-serverless-1/func-utils-rhel8 1.31.1-2, openshift-serverless-1/serving-queue-rhel8 1.10.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.10.0-4, openshift-serverless-1/kourier-control-rhel8 1.10.0-4, openshift-serverless-1/serving-webhook-rhel8 1.10.0-4, +34 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:0843
-
Red Hat RHACS 4.3 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.3.6-4, advanced-cluster-security/rhacs-roxctl-rhel8 4.3.6-2, advanced-cluster-security/rhacs-scanner-rhel8 4.3.6-3, advanced-cluster-security/rhacs-rhel8-operator 4.3.6-2, advanced-cluster-security/rhacs-collector-rhel8 4.3.6-3, advanced-cluster-security/rhacs-operator-bundle 4.3.6-4, +5 morefixed: vendor fix “In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.” RHSA-2024:1549
-
Red Hat Builds for Red Hat OpenShift 1.1.1 openshift-builds Red Hat multicluster-globalhub 1.0 for RHEL 8 multicluster-globalhub/multicluster-globalhub-agent-rhel8 v1.0.2-4, multicluster-globalhub/multicluster-globalhub-manager-rhel8 v1.0.2-4, multicluster-globalhub/multicluster-globalhub-rhel8-operator v1.0.2-4, multicluster-globalhub/multicluster-globalhub-operator-bundle v1.0.2-8 Red Hat Advanced Cluster Management for Kubernetes 2 hub-of-hubs-gitops, rhacm2/thanos-rhel8, rhacm2/openshift-hive-rhel8, rhacm2/search-collector-rhel9, rhacm2/submariner-rhel8-operator, rhacm2/cluster-curator-controller-rhel8, +4 more Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/thanos-rhel8 v2.9.2-1, rhacm2/console-rhel8 v2.9.2-2, rhacm2/memcached-rhel8 v2.9.2-1, rhacm2/prometheus-rhel8 v2.9.2-1, rhacm2/acm-grafana-rhel8 v2.9.2-1, rhacm2/acm-operator-bundle v2.9.2-4, +37 more Red Hat Ceph Storage 7.1 Tools liboath 2.6.2-3.el8cp, thrift 0.13.0-2.el8cp, gperftools 2.7-9.el8cp, libunwind 1.3.1-3.el8cp, oath-toolkit 2.6.2-3.el8cp, gperftools-libs 2.7-9.el8cp, +1 more Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 morenot affected: vulnerable code not present
+8 more productsfewer
Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 4 cri-o, openshift-clients, openshift-clients-redistributable Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202402131748-0, rhcos 412.86.202402272018-0, rhcos 412.86.202404162110-0, openshift4/ose-cli v4.12.0-202402081808.p0.gd4c9e3c.assembly.stream.el8, openshift4/ose-cli v4.12.0-202404170201.p0.gd691257.assembly.stream.el8, openshift4/ose-pod v4.12.0-202402081808.p0.g6df2177.assembly.stream.el8, +428 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202402060605-0, rhcos 413.92.202402131523-0, rhcos 413.92.202404232117-0, openshift4/ose-cli v4.13.0-202402011837.p0.g7780c37.assembly.stream, openshift4/ose-pod v4.13.0-202402060538.p0.g8f85140.assembly.stream, openshift4/ose-ptp v4.13.0-202402011837.p0.gc279a05.assembly.stream, +575 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202402010350-0, openshift4/ose-cli v4.14.0-202401292111.p0.g286cfa5.assembly.stream, openshift4/ose-pod v4.14.0-202401292111.p0.g28ed2d7.assembly.stream, openshift4/frr-rhel9 v4.14.0-202401302240.p0.g0414ca3.assembly.stream, openshift4/ose-tests v4.14.0-202401292111.p0.gc35d76d.assembly.stream, openshift4/ose-cli v4.14.0-202404161544.p0.gf7b14a9.assembly.stream.el8, +460 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202402201450-0, rhcos 415.92.202410232038-0, openshift4/ose-cli v4.15.0-202402082307.p0.g48dcf59.assembly.stream.el8, openshift4/ose-cli v4.15.0-202410230304.p0.g8231637.assembly.stream.el8, openshift4/frr-rhel9 v4.15.0-202402161907.p0.ga8191c0.assembly.stream.el9, openshift4/metallb-rhel9 v4.15.0-202401261531.p0.g5e58f41.assembly.stream, +416 more Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202406172220-0, openshift4/frr-rhel9 v4.16.0-202406131906.p0.g395104b.assembly.stream.el9, openshift4/metallb-rhel9 v4.16.0-202406131906.p0.g83eca94.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.16.0-202406131906.p0.ga245041.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9, openshift4/ose-ptp-rhel9 v4.16.0-202406131906.p0.g4447317.assembly.stream.el9, +226 more Red Hat Openshift Data Foundation 4 odf4/odr-rhel9-operator, odf4/odf-csi-addons-sidecar-rhel8, odf4/odf-csi-addons-rhel8-operator
2 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.51% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/go-git/go-git/v5 | >=5.0.0, <5.11.0 |
5.11.0 |
| go | gopkg.in/src-d/go-git.v4 | >=4.0.0, <=4.13.1 >=4.7.1 |
no fix listed |
Affected products
- go-git go-git
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49569
advisory
-
github.com
/go-git/go-git
package
Sources
- CVE List CVE-2023-49569
- GitHub Advisory GHSA-449p-3h89-pw88
- NVD CVE-2023-49569
- OSV GO-2024-2456
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.