CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.

This vulnerability does not affect the go-getter/v2 branch and package.

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

This update for trivy fixes the following issues:

Update to version 0.58.2 (

  boo#1234512, CVE-2024-45337,
  boo#1235265, CVE-2024-45338):

• fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)
• fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)
• fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)
• fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)
• fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)
• fix(sbom): use root package for unknown dependencies (if exists) [backport: release/v0.58] (#8156)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)
• fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)
• fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)
• chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)
• fix: handle BLOW_UNKNOWN error to download DBs [backport: release/v0.58] (#8121)
• fix(java): correctly overwrite version from depManagement if dependency uses project.* props [backport: release/v0.58] (#8119)
• release: v0.58.0 [main] (#7874)
• fix(misconf): wrap AWS EnvVar to iac types (#7407)
• chore(deps): Upgrade trivy-checks (#8018)
• refactor(misconf): Remove unused options (#7896)
• docs: add terminology page to explain Trivy concepts (#7996)
• feat: add workspaceRelationship (#7889)
• refactor(sbom): simplify relationship generation (#7985)
• docs: improve databases documentation (#7732)
• refactor: remove support for custom Terraform checks (#7901)
• docs: drop AWS account scanning (#7997)
• fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)
• fix(cli): Handle empty ignore files more gracefully (#7962)
• fix(misconf): load full Terraform module (#7925)
• fix(misconf): properly resolve local Terraform cache (#7983)
• refactor(k8s): add v prefix for Go packages (#7839)
• test: replace Go checks with Rego (#7867)
• feat(misconf): log causes of HCL file parsing errors (#7634)
• chore(deps): bump the aws group across 1 directory with 7 updates (#7991)
• chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)
• chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)
• chore: downgrade the failed block expand message to debug (#7964)
• fix(misconf): do not erase variable type for child modules (#7941)
• feat(go): construct dependencies of go.mod main module in the parser (#7977)
• feat(go): construct dependencies in the parser (#7973)
• feat: add cvss v4 score and vector in scan response (#7968)
• docs: add overview page for others (#7972)
• fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)
• feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)
• chore(deps): bump the common group with 4 updates (#7949)
• feat(oracle): add flavors support (#7858)
• fix(misconf): Update trivy-checks default repo to mirror.gcr.io (#7953)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• fix(k8s): check all results for vulnerabilities (#7946)
• ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)
• feat(secret): Add built-in secrets rules for Private Packagist (#7826)
• docs: Fix broken links (#7900)
• docs: fix mistakes/typos (#7942)
• feat: Update registry…

These are all security issues fixed in the trivy-0.58.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

Changes in trivy:

Update to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):

• fix: Use fetch-level: 1 to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)
• fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)
• fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)
• fix: add buildInfo for BlobInfo in rpc package [backport: release/v0.67] (#9615)
• fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)
• fix(vex): don't suppress vulns for packages with infinity loop (#9465)
• fix(aws): use BuildableClient insead of xhttp.Client (#9436)
• refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)
• docs: clarify inline ignore limitations for resource-less checks (#9537)
• fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)
• fix(misconf): handle tofu files in module detection (#9486)
• feat(seal): add seal support (#9370)
• docs: fix modules path and update code example (#9539)
• fix: close file descriptors and pipes on error paths (#9536)
• feat: add documentation URL for database lock errors (#9531)
• fix(db): Dowload database when missing but metadata still exists (#9393)
• feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)
• fix(misconf): unmark cty values before access (#9495)
• feat(cli): change --list-all-pkgs default to true (#9510)
• fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)
• refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)
• refactor: remove google/wire dependency and implement manual DI (#9509)
• chore(deps): bump the aws group with 6 updates (#9481)
• chore(deps): bump the common group across 1 directory with 24 updates (#9507)
• fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)
• docs: move info about detection priority into coverage section (#9469)
• feat(sbom): added support for CoreOS (#9448)
• fix(misconf): strip build metadata suffixes from image history (#9498)
• feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)
• docs: Fix typo in terraform docs (#9492)
• feat(redhat): add os-release detection for RHEL-based images (#9458)
• ci(deps): add 3-day cooldown period for Dependabot updates (#9475)
• refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)
• fix(vuln): compare nuget package names in lower case (#9456)
• chore: Update release flow to include chocolatey (#9460)
• docs: document eol supportability (#9434)
• docs(report): add nuanses about secret/license scanner in summary table (#9442)
• ci: use environment variables in GitHub Actions for improved security (#9433)
• chore: bump Go to 1.24.7 (#9435)
• fix(nodejs): use snapshot string as Package.ID for pnpm packages (#9330)
• ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)

Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):

• chore(deps): bump the aws group with 7 updates (#9419)
• refactor(secret): clarify secret scanner messages (#9409)
• fix(cyclonedx): handle multiple license types (#9378)
• fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
• test: add HTTP basic authentication to git test server (#9407)
• fix(sbom): add support for file component type of CycloneDX (#9372)
• fix(misconf): ensure module source is known (#9404)
• ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
• fix: create temp file under composite fs dir (#9387)
• chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
• refactor: switch to stable azcontainerregistry SDK package (#9319)
• chore(deps): bump the common…

This update for trivy fixes the following issues:

Update to version 0.68.2:

Security fixes:

• CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).
• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).
• CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).
• CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).
• CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).
• CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).
• CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).
• CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).
• CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251547).

Other fixes:

• Update installation.md (#8979)
• chore(alpine): add EOL date for Alpine 3.21 (#8221)
• chore(alpine): add EOL date for Alpine 3.22 (#8992)
• chore(cli): Remove Trivy Cloud (#9847)
• chore(deps): Bump trivy-checks (#7819)
• chore(deps): Bump trivy-checks (#8310)
• chore(deps): Bump trivy-checks (#8619)
• chore(deps): Bump trivy-checks (#8934)
• chore(deps): Bump trivy-checks to v1.7.1 (#8467)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• chore(deps): Switch to go-viper/mapstructure (#9579)
• chore(deps): Update trivy-checks (#8798)
• chore(deps): Upgrade trivy-checks (#8018)
• chore(deps): bump Go to v1.23.5 (#8341)
• chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 (#8105)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 (#8140)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
• chore(deps): bump alpine from…