CVE-2024-6257 — Command Injection in Shared Library

CWE-77 — Command Injection9 documents7 sources
Severity
8.8HIGHNVD
CNA8.4
EPSS
0.4%
top 39.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Hashicorp Shared LibraryGithub.com Hashicorp Go-getterHashicorp Go-getter
Timeline
PublishedJun 25
Latest updateJun 28

Description

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDhashicorp/go-getter< 1.7.5
▶CVEListV5hashicorp/shared_library< 1.7.4

🔴Vulnerability Details

5
OSV
Code Execution on Git update in github.com/hashicorp/go-getter↗2024-06-28
▶
OSV
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation↗2024-06-25
▶
GHSA
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation↗2024-06-25
▶
CVEList
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation↗2024-06-25
▶
OSV
CVE-2024-6257: HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to a↗2024-06-25
▶

📋Vendor Advisories

3
Red Hat
hashicorp/go-getter: Arbitrary command execution through local git config file↗2024-06-25
▶
Microsoft
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation↗2024-06-11
▶
Debian
CVE-2024-6257: golang-github-hashicorp-go-getter - HashiCorp’s go-getter library can be coerced into executing Git update on an exi...↗2024
▶
CVE-2024-6257 — Command Injection in Shared Library | cvebase