REDHAT-BUG-2335888
First published: Mon Jan 06 2025(Updated: )
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go-git | <5.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:0401
- https://access.redhat.com/errata/RHSA-2025:0662
- https://access.redhat.com/errata/RHSA-2025:0654
- https://access.redhat.com/errata/RHSA-2025:0907
- https://access.redhat.com/errata/RHSA-2025:1119
- https://access.redhat.com/errata/RHSA-2025:1334
- https://access.redhat.com/errata/RHSA-2025:1468
- https://bugzilla.redhat.com/show_bug.cgi?id=2335888
Frequently Asked Questions
What is the severity of REDHAT-BUG-2335888?
The severity of REDHAT-BUG-2335888 is considered critical due to the potential for arbitrary command execution.
How do I fix REDHAT-BUG-2335888?
To fix REDHAT-BUG-2335888, upgrade to go-git version 5.13.0 or later.
What versions of go-git are affected by REDHAT-BUG-2335888?
go-git versions prior to 5.13.0 are affected by REDHAT-BUG-2335888.
What type of vulnerability is REDHAT-BUG-2335888?
REDHAT-BUG-2335888 is an argument injection vulnerability.
Who are the affected users of REDHAT-BUG-2335888?
Users of go-git versions earlier than 5.13.0 are affected by REDHAT-BUG-2335888.
- agent/severity
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/references
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-21613
- vendor/the go authors
- canonical/go-git