Описание
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Trusted Application Pipeline | rhtap-contract-tenant/cli-v01 | Will not fix | ||
| Red Hat Trusted Application Pipeline | rhtap-contract-tenant/cli-v02 | Affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-77
https://bugzilla.redhat.com/show_bug.cgi?id=2294254hashicorp/go-getter: Arbitrary command execution through local git config file
EPSS
Процентиль: 28%
0.00095
Низкий
7.7 High
CVSS3
Связанные уязвимости
CVSS3: 8.4
ubuntu
около 1 года назад
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
CVSS3: 8.4
nvd
около 1 года назад
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
CVSS3: 8.4
debian
около 1 года назад
HashiCorp\u2019s go-getter library can be coerced into executing Git u ...
EPSS
Процентиль: 28%
0.00095
Низкий
7.7 High
CVSS3