CVE-2024-3817 — Argument Injection in Shared Library
Severity
9.8CRITICALNVD
EPSS
2.1%
top 15.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 17
Latest updateJul 15
Description
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.
This vulnerability does not affect the go-getter/v2 branch and package.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
5OSV▶
Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter↗2024-05-10
GHSA▶
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches↗2024-04-17
OSV▶
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches↗2024-04-17
OSV▶
CVE-2024-3817: HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches↗2024-04-17
CVEList▶
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches↗2024-04-17
📋Vendor Advisories
5Oracle▶
Oracle Oracle JD Edwards Risk Matrix: Enterprise Infrastructure SEC (OpenSSL) — CVE-2023-3817↗2024-07-15
Microsoft▶
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches↗2024-04-09
Debian▶
CVE-2024-3817: golang-github-hashicorp-go-getter - HashiCorp’s go-getter library is vulnerable to argument injection when executing...↗2024