Vulnerability in github.com/github/git-sizer: Running git executable within the repository on Windows
Summary
GO-2022-0424: On Windows, git-sizer might run a git executable within the repository being analyzed in github.com/github/git-sizer. Affects github.com/github/git-sizer versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/github/git-sizer is a Go package that provides a tool for computing various size metrics for a Git repository. It is commonly used to analyze the size and growth of repositories. This package utilizes the git executable to gather information about the repository being analyzed. However, on Windows, there is a vulnerability where the git-sizer tool might run a git executable within the repository being analyzed, leading to potential security risks.
Vulnerability Detail
The vulnerability in github.com/github/git-sizer arises from the improper execution of the git executable within the repository being analyzed. This can allow an attacker to execute arbitrary commands or access sensitive information within the repository. The vulnerability affects all versions of github.com/github/git-sizer prior to version 1.4.0. It is important to note that this vulnerability is specific to Windows systems.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/github/git-sizer@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the package to the fixed version as soon as possible.
Conclusion
The vulnerability in github.com/github/git-sizer allows for the execution of a git executable within the repository being analyzed on Windows systems. This can lead to potential security risks, including arbitrary command execution and access to sensitive information. It is crucial to update the package to version 1.4.0 or later to mitigate this vulnerability.
See every vulnerability recorded for github.com/github/git-sizer →
FAQ
github.com/github/git-sizer is a Go package that provides a tool for computing various size metrics for a Git repository. It is commonly used to analyze the size and growth of repositories.
The vulnerability allows an attacker to execute arbitrary commands or access sensitive information within the repository being analyzed.
All versions of github.com/github/git-sizer prior to version 1.4.0 are affected by this vulnerability.
Yes, this vulnerability is specific to Windows systems.
To fix this vulnerability, update the github.com/github/git-sizer package to version 1.4.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/github/git-sizer.
