golang-github-go-git-go-git: A path traversal vulnerability was discovered in go-git versions prior to v5.11
CVE-2023-49569 is fixed in 6 products on 1 platform, first by DEBIAN-CVE-2023-49569, released January 12, 2024. It is not reported as exploited. Patch Radar priority: Urgent.
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| amazon-ssm-agent · amzn 2023 | 3.2.2222.0-1.amzn2023 | ALAS2023-2024-526 | Feb 15, 2024 |
| amazon-ssm-agent-debuginfo · amzn 2023 | 3.2.2222.0-1.amzn2023 | ALAS2023-2024-526 | Feb 15, 2024 |
| amazon-ssm-agent-debugsource · amzn 2023 | 3.2.2222.0-1.amzn2023 | ALAS2023-2024-526 | Feb 15, 2024 |
| go-git · Ubuntu 22.04.1 LTS (jammy) | 5.4.2-3ubuntu0.1~esm1 | go-git 5.4.2-3ubuntu0.1~esm1 | Feb 9, 2026 |
| go-git · Ubuntu 24.04.5 LTS (noble) | 5.4.2-4ubuntu0.24.04.3+esm2 | go-git 5.4.2-4ubuntu0.24.04.3+esm2 | Feb 9, 2026 |
| golang-github-go-git-go-git · Debian 13.5 (trixie) | 5.11.0-1 | DEBIAN-CVE-2023-49569 | Jan 12, 2024 |
| golang-github-go-git-go-git · Debian 14 | 5.11.0-1 | DEBIAN-CVE-2023-49569 | Jan 12, 2024 |
| golang-github-go-git-go-git-dev · Ubuntu 22.04.1 LTS (jammy) | 5.4.2-3ubuntu0.1~esm1 | golang-github-go-git-go-git-dev 5.4.2-3ubuntu0.1~esm1 | Feb 9, 2026 |
| golang-github-go-git-go-git-dev · Ubuntu 24.04.5 LTS (noble) | 5.4.2-4ubuntu0.24.04.3+esm2 | golang-github-go-git-go-git-dev 5.4.2-4ubuntu0.24.04.3+esm2 | Feb 9, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.