Source: golang-github-go-git-go-git Version: 5.17.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for golang-github-go-git-go-git. CVE-2026-33762[0]: | go-git is an extensible git implementation library written in pure | Go. Prior to version 5.17.1, go-git’s index decoder for format | version 4 fails to validate the path name prefix length before | applying it to the previously decoded path name. A maliciously | crafted index file can trigger an out-of-bounds slice operation, | resulting in a runtime panic during normal index parsing. This issue | only affects Git index format version 4. Earlier formats (go-git | supports only v2 and v3) are not vulnerable to this issue. This | issue has been patched in version 5.17.1. CVE-2026-34165[1]: | go-git is an extensible git implementation library written in pure | Go. From version 5.0.0 to before version 5.17.1, a vulnerability has | been identified in which a maliciously crafted .idx file can cause | asymmetric memory consumption, potentially exhausting available | memory and resulting in a denial-of-service (DoS) condition. | Exploitation requires write access to the local repository's .git | directory, it order to create or alter existing .idx files. This | issue has been patched in version 5.17.1. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-33762 https://www.cve.org/CVERecord?id=CVE-2026-33762 https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8 [1] https://security-tracker.debian.org/tracker/CVE-2026-34165 https://www.cve.org/CVERecord?id=CVE-2026-34165 https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp Please adjust the affected versions in the BTS as needed. Regards, Salvatore
