Maliciously crafted Git server replies can cause DoS on go-git clients
Summary
Maliciously crafted Git server replies can cause DoS on go-git clients
Original description
The description as published by the source.
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability.
This is a go-git implementation issue and does not affect the upstream git cli.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-49568 golang-github-go-git-go-git
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov