chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security]#2724
chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security]#2724redhat-renovate-bot wants to merge 1 commit into
Conversation
…curity] Signed-off-by: redhat-renovate-bot <redhat-internal-renovate@redhat.com>
redhat-renovate-bot
added
the
release-note-none
kubevirt-bot
added
the
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the go-git dependency to v5.19.1 and introduces extensive security hardening measures. Key improvements include robust path validation to detect HFS+ and NTFS variants of .git and .gitmodules, protection against path traversal in submodules, and enforcement of resource limits such as maximum delta chain depth and pre-allocation caps. Additionally, it adds shell-quoting for SSH commands, improves LEB128 decoding with overflow checks, and ensures that inflated packfile objects do not exceed their declared sizes. I have no feedback to provide as there were no review comments to assess.
2 participants
This PR contains the following updates:
v5.19.0→v5.19.1GitHub Vulnerability Alerts
CVE-2026-45570
Impact
go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. This diverges from canonical Git, which shell-quotes the path throughsq_quote_bufso that an embedded'becomes the'\''close-escape-reopen sequence and the whole path round-trips as a single quoted argument.A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. On SSH servers that evaluate the exec command through a shell (for example a user account whose login shell is
/bin/shor/bin/bash, or aForceCommandwrapper that re-evaluates$SSH_ORIGINAL_COMMAND), those additional tokens execute in that account's command-execution context. SSH servers that tokenize the exec command without shell evaluation, including the canonicalgit-shellsetup, are not affected.The vulnerable behaviour is on the SSH server side, not in
go-git: the same bytes can be produced by any SSH client. The change ingo-gitis defense-in-depth that restores parity with canonical Git's wire format and preventsgo-gitfrom being a vehicle for reaching shell-evaluating servers through attacker-influenced repository paths.Patches
Users should upgrade to a patched version in order to mitigate this issue. The fix ports
sq_quote_buffrom canonical Git intogo-git's SSH transport so that the wire output is byte-identical to whatgititself would send for the same input.Versions prior to
v5are likely to be affected, users are recommended to upgrade to a supported go-git version.Credit
Thanks to @N0zoM1z0 for reporting this to the
go-gitproject. 🙇CVE-2026-45571
Impact
A path validation issue in
go-gitcould allow crafted repository data to affect files outside the intended checkout target, including the repository's.gitdirectory.These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.
Using non-descendant
go-billyfilesystem instances, or different filesystem types, for theStorerandWorktreemay provide some isolation against.gitdirectory manipulation. For example, users that store the.gitdirectory throughmemfswhile usingosfsfor the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.However, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.
It is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.
Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to
v5are likely to be affected, users are recommended to upgrade to a supported go-git version.Credits
Thanks to @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this to the go-git project in three separate reports. 🙇
go-git: Improper single-quote escaping in go-git SSH transport
CVE-2026-45570 / GHSA-m7cr-m3pv-hgrp
More information
Details
Impact
go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. This diverges from canonical Git, which shell-quotes the path throughsq_quote_bufso that an embedded'becomes the'\''close-escape-reopen sequence and the whole path round-trips as a single quoted argument.A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. On SSH servers that evaluate the exec command through a shell (for example a user account whose login shell is
/bin/shor/bin/bash, or aForceCommandwrapper that re-evaluates$SSH_ORIGINAL_COMMAND), those additional tokens execute in that account's command-execution context. SSH servers that tokenize the exec command without shell evaluation, including the canonicalgit-shellsetup, are not affected.The vulnerable behaviour is on the SSH server side, not in
go-git: the same bytes can be produced by any SSH client. The change ingo-gitis defense-in-depth that restores parity with canonical Git's wire format and preventsgo-gitfrom being a vehicle for reaching shell-evaluating servers through attacker-influenced repository paths.Patches
Users should upgrade to a patched version in order to mitigate this issue. The fix ports
sq_quote_buffrom canonical Git intogo-git's SSH transport so that the wire output is byte-identical to whatgititself would send for the same input.Versions prior to
v5are likely to be affected, users are recommended to upgrade to a supported go-git version.Credit
Thanks to @N0zoM1z0 for reporting this to the
go-gitproject. 🙇Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
go-git: Crafted repositories may modify main and submodule .git directories
CVE-2026-45571 / GHSA-crhj-59gh-8x96
More information
Details
Impact
A path validation issue in
go-gitcould allow crafted repository data to affect files outside the intended checkout target, including the repository's.gitdirectory.These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.
Using non-descendant
go-billyfilesystem instances, or different filesystem types, for theStorerandWorktreemay provide some isolation against.gitdirectory manipulation. For example, users that store the.gitdirectory throughmemfswhile usingosfsfor the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.However, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.
It is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.
Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to
v5are likely to be affected, users are recommended to upgrade to a supported go-git version.Credits
Thanks to @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this to the go-git project in three separate reports. 🙇
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
go-git/go-git (github.com/go-git/go-git/v5)
v5.19.1Compare Source
What's Changed
worktreeFilesystemwrapper for worktree and hardening by @hiddeco in #2100Full Changelog: go-git/go-git@v5.19.0...v5.19.1
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.