CVE-2024-6257

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .

An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

Root has patched CVE-2024-6257 in the github.com/hashicorp/go-getter package for Root:Go. Multiple fixed versions available.

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

trivy was updated to fix the following issues:

Update to version 0.54.1:

• fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
• fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
• fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
• docs: update ecosystem page reporting with plopsec.com app (#7262)
• feat(vex): retrieve VEX attestations from OCI registries (#7249)
• feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
• refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
• fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
• chore: show VEX notice for OSS maintainers in CI environments (#7246)
• feat(vuln): add --pkg-relationships (#7237)
• docs: show VEX cli pages + update config file page for VEX flags (#7244)
• fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
• feat(vex): VEX Repository support (#7206)
• fix(secret): skip regular strings contain secret patterns (#7182)
• feat: share build-in rules (#7207)
• fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
• fix(cli): error on missing config file (#7154)
• fix(secret): update length of hugging-face-access-token (#7216)
• feat(sbom): add vulnerability support for SPDX formats (#7213)
• fix(secret): trim excessively long lines (#7192)
• chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
• fix(server): pass license categories to options (#7203)
• feat(mariner): Add support for Azure Linux (#7186)
• docs: updates config file (#7188)
• refactor(fs): remove unused field for CompositeFS (#7195)
• fix: add missing platform and type to spec (#7149)
• feat(misconf): enabled China configuration for ACRs (#7156)
• fix: close file when failed to open gzip (#7164)
• docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
• docs(misconf): add info about limitations for terraform plan json (#7143)
• chore: add VEX for Trivy images (#7140)
• chore: add VEX document and generator for Trivy (#7128)
• fix(misconf): do not evaluate TF when a load error occurs (#7109)
• feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
• refactor(secret): move warning about file size after IsBinary check (#7123)
• feat: add openSUSE tumbleweed detection and scanning (#6965)
• test: add missing advisory details for integration tests database (#7122)
• fix: Add dependencyManagement exclusions to the child exclusions (#6969)
• fix: ignore nodes when listing permission is not allowed (#7107)
• fix(java): use go-mvn-version to remove Package duplicates (#7088)
• refactor(secret): add warning about large files (#7085)
• feat(nodejs): add license parser to pnpm analyser (#7036)
• refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
• feat: add log.FilePath() function for logger (#7080)
• chore: bump golangci-lint from v1.58 to v1.59 (#7077)
• perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
• refactor: pass DB dir to trivy-db (#7057)
• docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

• feat(conda): add licenses support for environment.yml files (#6953)
• fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
• feat: add memory cache backend (#7048)
• fix(sbom): use package UIDs for uniqueness (#7042)
• feat(php): add installed.json file support (#4865)
• docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
• fix: use embedded when command path not found (#7037)
• refactor: use google/wire for cache (#7024)
• fix(cli): show info message only when --scanners is available (#7032)
• chore:…

trivy was updated to fix the following issues:

Update to version 0.54.1:

• fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
• fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
• fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
• release: v0.54.0 [main] (#7075)
• docs: update ecosystem page reporting with plopsec.com app (#7262)
• feat(vex): retrieve VEX attestations from OCI registries (#7249)
• feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
• refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
• fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
• chore: show VEX notice for OSS maintainers in CI environments (#7246)
• feat(vuln): add --pkg-relationships (#7237)
• docs: show VEX cli pages + update config file page for VEX flags (#7244)
• fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
• feat(vex): VEX Repository support (#7206)
• fix(secret): skip regular strings contain secret patterns (#7182)
• feat: share build-in rules (#7207)
• fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
• fix(cli): error on missing config file (#7154)
• fix(secret): update length of hugging-face-access-token (#7216)
• feat(sbom): add vulnerability support for SPDX formats (#7213)
• fix(secret): trim excessively long lines (#7192)
• chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
• fix(server): pass license categories to options (#7203)
• feat(mariner): Add support for Azure Linux (#7186)
• docs: updates config file (#7188)
• refactor(fs): remove unused field for CompositeFS (#7195)
• fix: add missing platform and type to spec (#7149)
• feat(misconf): enabled China configuration for ACRs (#7156)
• fix: close file when failed to open gzip (#7164)
• docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
• docs(misconf): add info about limitations for terraform plan json (#7143)
• chore: add VEX for Trivy images (#7140)
• chore: add VEX document and generator for Trivy (#7128)
• fix(misconf): do not evaluate TF when a load error occurs (#7109)
• feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
• refactor(secret): move warning about file size after IsBinary check (#7123)
• feat: add openSUSE tumbleweed detection and scanning (#6965)
• test: add missing advisory details for integration tests database (#7122)
• fix: Add dependencyManagement exclusions to the child exclusions (#6969)
• fix: ignore nodes when listing permission is not allowed (#7107)
• fix(java): use go-mvn-version to remove Package duplicates (#7088)
• refactor(secret): add warning about large files (#7085)
• feat(nodejs): add license parser to pnpm analyser (#7036)
• refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
• feat: add log.FilePath() function for logger (#7080)
• chore: bump golangci-lint from v1.58 to v1.59 (#7077)
• perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
• refactor: pass DB dir to trivy-db (#7057)
• docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

• release: v0.53.0 [main] (#6855)
• feat(conda): add licenses support for environment.yml files (#6953)
• fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
• feat: add memory cache backend (#7048)
• fix(sbom): use package UIDs for uniqueness (#7042)
• feat(php): add installed.json file support (#4865)
• docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
• fix: use embedded when command path not found (#7037)
• refactor: use google/wire for cache (#7024)
• fix(cli): show…

These are all security issues fixed in the trivy-0.53.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the conftest-0.54.0-1.1 package on the GA media of openSUSE Tumbleweed.