SB2024080809 - Privilege escalation in HashiCorp go-getter 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024080809

SB2024080809 - Privilege escalation in HashiCorp go-getter

Published: August 8, 2024

Security Bulletin ID SB2024080809
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Insufficient verification of data authenticity (CVE-ID: CVE-2024-6257)

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to the way the Git config is handled by the library. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.


Remediation

Install update from vendor's website.

References