id: GO-2024-2456
modules:
    - module: gopkg.in/src-d/go-git.v4
      versions:
        - introduced: 4.7.1
      vulnerable_at: 4.13.1
    - module: github.com/go-git/go-git/v5
      versions:
        - introduced: 5.0.0
        - fixed: 5.11.0
      vulnerable_at: 5.10.1
      packages:
        - package: github.com/go-git/go-git/v5
          symbols:
            - checkFastForwardUpdate
            - isFastForward
            - InitWithOptions
            - Repository.CreateTag
            - Worktree.PullContext
            - Worktree.createBranch
            - Worktree.checkoutFileSymlink
          derived_symbols:
            - AddOptions.Validate
            - Blame
            - BlameResult.String
            - Clone
            - CloneContext
            - CommitOptions.Validate
            - CreateTagOptions.Validate
            - GrepOptions.Validate
            - GrepResult.String
            - Init
            - NoMatchingRefSpecError.Error
            - Open
            - PlainClone
            - PlainCloneContext
            - PlainInit
            - PlainInitWithOptions
            - PlainOpen
            - PlainOpenWithOptions
            - Remote.Fetch
            - Remote.FetchContext
            - Remote.List
            - Remote.ListContext
            - Remote.Push
            - Remote.PushContext
            - Remote.String
            - Repository.BlobObject
            - Repository.BlobObjects
            - Repository.Branch
            - Repository.Branches
            - Repository.CommitObject
            - Repository.CommitObjects
            - Repository.Config
            - Repository.ConfigScoped
            - Repository.CreateBranch
            - Repository.CreateRemote
            - Repository.CreateRemoteAnonymous
            - Repository.DeleteBranch
            - Repository.DeleteObject
            - Repository.DeleteRemote
            - Repository.DeleteTag
            - Repository.Fetch
            - Repository.FetchContext
            - Repository.Grep
            - Repository.Head
            - Repository.Log
            - Repository.Notes
            - Repository.Object
            - Repository.Objects
            - Repository.Prune
            - Repository.Push
            - Repository.PushContext
            - Repository.Reference
            - Repository.References
            - Repository.Remote
            - Repository.Remotes
            - Repository.RepackObjects
            - Repository.ResolveRevision
            - Repository.SetConfig
            - Repository.Tag
            - Repository.TagObject
            - Repository.TagObjects
            - Repository.Tags
            - Repository.TreeObject
            - Repository.TreeObjects
            - ResetOptions.Validate
            - Status.String
            - Submodule.Init
            - Submodule.Repository
            - Submodule.Status
            - Submodule.Update
            - Submodule.UpdateContext
            - SubmoduleStatus.String
            - Submodules.Init
            - Submodules.Status
            - Submodules.Update
            - Submodules.UpdateContext
            - SubmodulesStatus.String
            - Worktree.Add
            - Worktree.AddGlob
            - Worktree.AddWithOptions
            - Worktree.Checkout
            - Worktree.Clean
            - Worktree.Commit
            - Worktree.Grep
            - Worktree.Move
            - Worktree.Pull
            - Worktree.Remove
            - Worktree.RemoveGlob
            - Worktree.Reset
            - Worktree.ResetSparsely
            - Worktree.Status
            - Worktree.Submodule
            - Worktree.Submodules
            - buildTreeHelper.BuildTree
        - package: github.com/go-git/go-git/v5/config
          symbols:
            - RemoteConfig.Validate
            - Branch.Validate
          derived_symbols:
            - Config.Unmarshal
            - Config.Validate
            - LoadConfig
            - ReadConfig
        - package: github.com/go-git/go-git/v5/plumbing/object
          symbols:
            - getFileStatsFromFilePatches
          derived_symbols:
            - Commit.Stats
            - Commit.StatsContext
            - Patch.Stats
        - package: github.com/go-git/go-git/v5/storage/filesystem
          symbols:
            - NewStorageWithOptions
          derived_symbols:
            - ConfigStorage.Config
            - ConfigStorage.SetConfig
            - ModuleStorage.Module
            - NewStorage
            - ObjectStorage.EncodedObject
        - package: github.com/go-git/go-git/v5/storage/filesystem/dotgit
          symbols:
            - DotGit.Alternates
summary: |-
    Path traversal and RCE in github.com/go-git/go-git/v5 and
    gopkg.in/src-d/go-git.v4
cves:
    - CVE-2023-49569
ghsas:
    - GHSA-449p-3h89-pw88
credits:
    - Ionut Lalu
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-49569
notes:
    - Symbols were obtained by looking at every change between 5.10.1 and 5.11.0.
review_status: REVIEWED