CVE-2024-3817: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
Other sources
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.
This vulnerability does not affect the go-getter/v2 branch and package.
— NVD
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.
An attacker may format a Git URL in order to inject additional Git arguments to the Git call.
Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hashicorp/go-getterto a version that resolves this vulnerability.Fixed in 1.7.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.3.2-14 - Upgrade
Upgrade
HashiCorp go-getterto a version that resolves this vulnerability.Fixed in 1.7.4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3817?
CVE-2024-3817 is classified as a moderate severity vulnerability due to potential argument injection that could lead to unintended command execution.
How do I fix CVE-2024-3817?
To fix CVE-2024-3817, upgrade the go-getter package to version 1.7.4 or higher, as the vulnerability does not affect versions starting from 1.7.4.
What software is affected by CVE-2024-3817?
CVE-2024-3817 affects the go-getter package versions between 1.5.9 and 1.7.4, excluding version 1.7.4.
What type of vulnerability is CVE-2024-3817?
CVE-2024-3817 is an argument injection vulnerability that occurs when executing Git commands to interact with remote branches.
Is there a way to test for CVE-2024-3817 in my environment?
You can test for CVE-2024-3817 by checking the version of the go-getter package in use and reviewing your usage patterns for Git operations.