Commit cd15202
authored
fix(deps): update module github.com/go-git/go-git/v5 to v5.18.0 [security] (#2728)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git)
| `v5.17.1` → `v5.18.0` |
|
|
### GitHub Vulnerability Alerts
####
[GHSA-3xc5-wrhm-f963](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963)
### Impact
`go-git` may leak HTTP authentication credentials when following
redirects during smart-HTTP clone and fetch operations.
If a remote repository responds to the initial `/info/refs` request with
a redirect to a different host, go-git updates the session endpoint to
the redirected location and reuses the original authentication for
subsequent requests. This can result in the credentials (e.g.
Authorization headers) being sent to an unintended host.
An attacker controlling or influencing the redirect target can capture
these credentials and potentially reuse them to access the victim’s
repositories or other resources, depending on the scope of the
credential.
**Clients using `go-git` exclusively with trusted remotes (for example,
GitHub or GitLab), and over a secure HTTPS connection, are not affected
by this issue.** The risk arises when interacting with untrusted or
misconfigured Git servers, or when using unsecured HTTP connections,
which is not recommended. Such configurations also expose clients to a
broader class of security risks beyond this issue, including credential
interception and tampering of repository data.
### Patches
Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to
mitigate this vulnerability. Versions prior to v5 are likely to be
affected, users are recommended to upgrade to a supported `go-git`
version.
The patched versions add support for configuring
[followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects).
In line with upstream behaviour, the default is now `initial`, while
users can opt into `FollowRedirects` or `NoFollowRedirects`
programmatically.
### Credit
Thanks to the 3 separate reports from @​celinke97,
@​N0zoM1z0 and @​AyushParkara. Thanks for finding and
reporting this issue privately to the `go-git` project. 🙇
##### Severity
- CVSS Score: 4.7 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N`
---
### go-git: Credential leak via cross-host redirect in smart HTTP
transport
[GHSA-3xc5-wrhm-f963](https://redirect.github.com/advisories/GHSA-3xc5-wrhm-f963)
<details>
<summary>More information</summary>
#### Details
##### Impact
`go-git` may leak HTTP authentication credentials when following
redirects during smart-HTTP clone and fetch operations.
If a remote repository responds to the initial `/info/refs` request with
a redirect to a different host, go-git updates the session endpoint to
the redirected location and reuses the original authentication for
subsequent requests. This can result in the credentials (e.g.
Authorization headers) being sent to an unintended host.
An attacker controlling or influencing the redirect target can capture
these credentials and potentially reuse them to access the victim’s
repositories or other resources, depending on the scope of the
credential.
**Clients using `go-git` exclusively with trusted remotes (for example,
GitHub or GitLab), and over a secure HTTPS connection, are not affected
by this issue.** The risk arises when interacting with untrusted or
misconfigured Git servers, or when using unsecured HTTP connections,
which is not recommended. Such configurations also expose clients to a
broader class of security risks beyond this issue, including credential
interception and tampering of repository data.
##### Patches
Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to
mitigate this vulnerability. Versions prior to v5 are likely to be
affected, users are recommended to upgrade to a supported `go-git`
version.
The patched versions add support for configuring
[followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects).
In line with upstream behaviour, the default is now `initial`, while
users can opt into `FollowRedirects` or `NoFollowRedirects`
programmatically.
##### Credit
Thanks to the 3 separate reports from @​celinke97,
@​N0zoM1z0 and @​AyushParkara. Thanks for finding and
reporting this issue privately to the `go-git` project. 🙇
#### Severity
- CVSS Score: 4.7 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N`
#### References
-
[https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963)
-
[https://github.com/go-git/go-git](https://redirect.github.com/go-git/go-git)
This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>go-git/go-git (github.com/go-git/go-git/v5)</summary>
###
[`v5.18.0`](https://redirect.github.com/go-git/go-git/releases/tag/v5.18.0)
[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.17.2...v5.18.0)
#### What's Changed
- plumbing: transport/http, Add support for followRedirects policy by
[@​pjbgf](https://redirect.github.com/pjbgf) in
[#​2004](https://redirect.github.com/go-git/go-git/pull/2004)
**Full Changelog**:
<go-git/go-git@v5.17.2...v5.18.0>
###
[`v5.17.2`](https://redirect.github.com/go-git/go-git/releases/tag/v5.17.2)
[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.17.1...v5.17.2)
#### What's Changed
- build: Update module github.com/go-git/go-git/v5 to v5.17.1
\[SECURITY] (releases/v5.x) by
[@​go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in [#​1941](https://redirect.github.com/go-git/go-git/pull/1941)
- dotgit: skip writing pack files that already exist on disk by
[@​pjbgf](https://redirect.github.com/pjbgf) in
[#​1944](https://redirect.github.com/go-git/go-git/pull/1944)
:warning: This release fixes a bug
([#​1942](https://redirect.github.com/go-git/go-git/issues/1942))
that blocked some users from upgrading to `v5.17.1`. Thanks
[@​pskrbasu](https://redirect.github.com/pskrbasu) for reporting
it. 🙇
**Full Changelog**:
<go-git/go-git@v5.17.1...v5.17.2>
</details>
---
### Configuration
📅 **Schedule**: (in timezone Australia/Sydney)
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/google/osv-scanner).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjEyMy44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->1 parent cb871ef commit cd15202
2 files changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
13 | | - | |
| 13 | + | |
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
216 | 216 | | |
217 | 217 | | |
218 | 218 | | |
219 | | - | |
220 | | - | |
| 219 | + | |
| 220 | + | |
221 | 221 | | |
222 | 222 | | |
223 | 223 | | |
| |||
0 commit comments