CVE-2024-6257

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-6257

CGA ID

CGA-gfpc-w452-j2h8

Severity

8.4

High

CVSS V3

Description

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

References

https://images.chainguard.dev/security/CGA-gfpc-w452-j2h8
https://github.com/advisories/GHSA-xfhp-jf8p-mh5w
https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081
https://security-tracker.debian.org/tracker/CVE-2024-6257

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CVE-2024-6257

Severity

Description

References

Affected packages

Product

Why Chainguard

Customers

Company

Resources