Denial of Service Vulnerability in go-git Package: CVE-2023-49568
Summary
UBUNTU-CVE-2023-49568: A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Affects golang-github-go-git-go-git versions 5.4.2-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The go-git package is a pure Go implementation of the Git version control system, allowing developers to interact with Git repositories programmatically. It is widely used in applications that require Git functionalities without relying on the command-line interface. This package supports various operations such as cloning, committing, and pushing changes to repositories. However, it has been identified to have a vulnerability that could lead to denial of service attacks under specific conditions.
Vulnerability Detail
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This issue is specific to the go-git implementation and does not impact the upstream git command-line interface.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not possible, consider restricting access to the Git server to trusted sources only, or use an in-memory filesystem for operations that do not require external Git server interactions.
Conclusion
The CVE-2023-49568 vulnerability in the go-git package poses a significant risk of denial of service attacks. Users are strongly advised to update to the patched version to mitigate this risk. By following the recommended steps and utilizing tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for golang-github-go-git-go-git →
FAQ
CVE-2023-49568 is a vulnerability in the go-git package that allows for denial of service attacks through specially crafted responses from a Git server.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without needing to sign up.
The vulnerability can lead to resource exhaustion in go-git clients, potentially causing applications to become unresponsive or crash.
Yes, the vulnerability is patched in go-git version 5.11 and later. It is recommended to update to this version or newer.
As a temporary measure, restrict access to the Git server to trusted sources or use an in-memory filesystem for operations that do not require external Git server interactions.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-go-git-go-git.
