Source: golang-github-go-git-go-git Version: 5.19.1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: clone -1 -2 Control: reassign -2 src:golang-github-go-git-go-git-v6 6.0.0~alpha.4-2 Control: retitle -2 golang-github-go-git-go-git-v6: CVE-2026-71556 CVE-2026-71557
Hi, The following vulnerabilities were published for golang-github-go-git-go-git. CVE-2026-71556[0]: | go-git is an extensible git implementation library written in pure | Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations | (including checkout, status, and add) resolve symbolic links inside | the working tree without confining resolution to the worktree | boundary, so a maliciously crafted repository containing a symlink | can cause go-git to read from or write to files outside the intended | working directory when the repository is cloned and its worktree | operations are used. Versions 5.19.2 and 6.0.0-alpha.5. CVE-2026-71557[1]: | go-git is an extensible git implementation library written in pure | Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not | sanitized before being used to construct on-disk paths under the | reference storage directory, so a maliciously crafted reference name | (for example containing directory-traversal sequences) can cause go- | git to write files outside the intended reference storage directory. | Versions 5.19.2 and 6.0.0-alpha.5 fix the issue. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-71556 https://www.cve.org/CVERecord?id=CVE-2026-71556 [1] https://security-tracker.debian.org/tracker/CVE-2026-71557 https://www.cve.org/CVERecord?id=CVE-2026-71557 Regards, Salvatore
