Skip to content
OpenAdvisories
Critical · 9.2 CVE-2025-21613 EUVD-2025-0045GHSA-v725-9546-7q7mGO-2025-3368

go-git has an Argument Injection via the URL field

Published Jan 6, 2025 · Updated Jan 6, 2025 · Assigned by GitHub_M

Vendor: go-git Product: go-git Package: apko Package: argo-events Package: argo-workflows Package: argocd-image-updater Package: argocd-image-updater-compat Package: bom Package: chezmoi Package: cri-o Package: crossplane-crank Package: dagger Package: flux Package: flux-image-automation-controller Package: flux-image-automation-controller-compat Package: flux-image-automation-controller-iamguarded-compat Package: flux-kustomize-controller Package: flux-kustomize-controller-iamguarded-compat Package: flux-source-controller Package: flux-source-controller-iamguarded-compat Package: gitea Package: gitea-compat Package: github.com/go-git/go-git/v4 Package: github.com/go-git/go-git/v5 Package: gitsign Package: gitsign-config Package: gitsign-credential-cache Package: go-licenses Package: golang-github-go-git-go-git Package: golang-github-go-git-go-git Package: gopkg.in/src-d/go-git.v4 Package: goreleaser Package: gptscript Package: grafana-alloy Package: grype Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: k8sgpt Package: k9s Package: kaniko Package: kaniko-compat Package: kaniko-warmer Package: kaniko-warmer-compat Package: kargo Package: kargo-oci-compat Package: kots Package: kots-compat Package: kots-symlink-compat Package: kubescape Package: kubevela Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubevela-vela-core-compat Package: melange Package: nuclei Package: osv-scanner Package: packer Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-go Package: pulumi-language-java Package: pulumi-language-nodejs Package: pulumi-language-python Package: pulumi-language-yaml Package: scorecard Package: skaffold Package: snyk-cli Package: src-fingerprint Package: syft Package: task Package: tfsec Package: timoni Package: trivy Package: wolfictl Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Affected products

VendorProductAffectedFixed
go-git go-git >= 4.0.0, < 5.13.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-github-go-git-go-git 5.13.2-1 —
Debian 13 golang-github-go-git-go-git 5.13.2-1 —
Debian 12 golang-github-go-git-go-git No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS golang-github-go-git-go-git 5.4.2-4ubuntu0.24.04.3+esm2 USN-8088-1
Ubuntu Pro 22.04 LTS golang-github-go-git-go-git 5.4.2-3ubuntu0.1~esm1 USN-8088-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 grafana +1 10.2.6-9.el9_5 RHSA-2025:3344
RHEL 8 grafana +1 9.2.10-21.el8_10 RHSA-2025:0401
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS grafana +1 9.2.10-21.el9_4 RHSA-2025:0662

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 grafana +1 9.2.10-21.el8_10 ALSA-2025:0401

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 grafana 9.2.10-21.el8_10 RLSA-2025:0401

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 amazon-ssm-agent 3.3.1611.0-150000.5.20.1 SUSE-SU-2025:0277-1
SLES 15 SP6 brise 20230603+git.5fdd2d6-150600.3.8.1 SUSE-SU-2025:0601-1
SLES 15 SP6 govulncheck-vulndb 0.0.20250108T191942-150000.1.26.1 SUSE-SU-2025:0060-1
SLES 15 SP6 grafana 10.4.15-150200.3.64.1 SUSE-SU-2025:0623-1
SLES 15 SP5 amazon-ssm-agent 3.3.1611.0-150000.5.20.1 SUSE-SU-2025:0277-1
SLES 15 SP4 amazon-ssm-agent 3.3.1611.0-150000.5.20.1 SUSE-SU-2025:0277-1
SLES 15 SP3 amazon-ssm-agent 3.3.1611.0-150000.5.20.1 SUSE-SU-2025:0277-1
SLES 12 amazon-ssm-agent 3.3.1611.0-4.36.1 SUSE-SU-2025:0191-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP6 trivy 0.58.2-bp156.2.6.1 openSUSE-SU-2025:0056-1
SUSE Manager Client Tools 15 grafana 10.4.15-150000.1.71.1 SUSE-SU-2025:0624-1
SUSE Manager Client Tools 12 grafana 10.4.15-1.71.1 SUSE-SU-2025:0622-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed amazon-ssm-agent 3.3.1611.0-1.1 openSUSE-SU-2025:14658-1
openSUSE Tumbleweed brise 20230603+git.5fdd2d6-5.1 openSUSE-SU-2025:14752-1
openSUSE Tumbleweed cheat 4.4.2-2.1 openSUSE-SU-2025:15487-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250108T191942-1.1 openSUSE-SU-2025:14624-1
openSUSE Tumbleweed grafana 11.3.0-5.1 openSUSE-SU-2025:14654-1
openSUSE Tumbleweed rime-plum-go 1.0.3-1.1 openSUSE-SU-2025:14902-1
openSUSE Tumbleweed rz-pm 0.3.3+git~14~gcee0d0d-1.1 openSUSE-SU-2025:15438-1
openSUSE Tumbleweed trivy 0.58.2-1.1 openSUSE-SU-2025:14713-1
openSUSE Leap 16.0 cheat 4.4.2-bp160.2.1 openSUSE-SU-2025:20177-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 amazon-ssm-agent 3.3.1611.0-150000.5.20.1 SUSE-SU-2025:0277-1
openSUSE Leap 15.6 brise 20230603+git.5fdd2d6-150600.3.8.1 SUSE-SU-2025:0601-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20250108T191942-150000.1.26.1 SUSE-SU-2025:0060-1
openSUSE Leap 15.6 grafana 10.4.15-150200.3.64.1 SUSE-SU-2025:0623-1
openSUSE Leap 15.6 trivy 0.58.2-bp156.2.6.1 openSUSE-SU-2025:0056-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-ssm-agent 3.3.1611.0-1.amzn2023 ALAS2023-2025-824
Amazon Linux 2 amazon-ssm-agent 3.3.1611.0-1.amzn2 ALAS2-2025-2739

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cri-o No fix yet —
Azure Linux 3 packer 1.9.5-5 —
Azure Linux 2 (CBL-Mariner) cri-o 1.22.3-12 —
Azure Linux 2 (CBL-Mariner) packer 1.9.5-7 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 grafana +1 9.2.10-21.el8_10 ELSA-2025-0401

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apko 0.22.5-r0 —
Wolfi rolling argo-events 1.9.3-r3 —
Wolfi rolling argo-workflows 3.6.2-r4 —
Wolfi rolling argocd-image-updater +1 0.15.2-r1 —
Wolfi rolling bom 0.6.0-r14 —
Wolfi rolling chezmoi 2.57.0-r1 —
Wolfi rolling crossplane-crank 1.18.2-r2 —
Wolfi rolling dagger 0.15.1-r3 —
Wolfi rolling flux 2.4.0-r3 —
Wolfi rolling flux-image-automation-controller +2 0.39.0-r5 —
Wolfi rolling flux-kustomize-controller +1 1.4.0-r4 —
Wolfi rolling flux-source-controller +1 1.4.1-r6 —
Wolfi rolling gitea +1 1.22.6-r2 —
Wolfi rolling gitsign +2 0.12.0-r1 —
Wolfi rolling go-licenses 1.6.0-r20 —
Wolfi rolling goreleaser 2.5.1-r1 —
Wolfi rolling gptscript 0.9.5-r4 —
Wolfi rolling grafana-alloy 1.5.1-r3 —
Wolfi rolling grype 0.86.1-r2 —
Wolfi rolling guac +4 0.12.4-r1 —
Wolfi rolling k8sgpt 0.3.48-r3 —
Wolfi rolling k9s 0.32.7-r3 —
Wolfi rolling kaniko +3 1.23.2-r8 —
Wolfi rolling kargo +1 1.1.2-r1 —
Wolfi rolling kots +2 1.123.0-r1 —
Wolfi rolling kubescape 3.0.22-r3 —
Wolfi rolling kubevela +3 1.9.13-r6 —
Wolfi rolling melange 0.18.3-r1 —
Wolfi rolling nuclei 3.3.7-r3 —
Wolfi rolling osv-scanner 1.9.2-r1 —
Wolfi rolling pulumi +3 3.145.0-r0 —
Wolfi rolling pulumi-kubernetes-operator 1.16.0-r6 —
Wolfi rolling pulumi-language-dotnet 3.71.1-r2 —
Wolfi rolling pulumi-language-java 1.6.0-r1 —
Wolfi rolling pulumi-language-yaml 1.13.0-r3 —
Wolfi rolling scorecard 5.0.0-r5 —
Wolfi rolling skaffold 2.13.2-r5 —
Wolfi rolling snyk-cli 1.1294.3-r2 —
Wolfi rolling src-fingerprint 0.19.0-r21 —
Wolfi rolling syft 1.18.1-r2 —
Wolfi rolling task 3.40.1-r3 —
Wolfi rolling tfsec 1.28.12-r1 —
Wolfi rolling timoni 0.23.0-r3 —
Wolfi rolling trivy 0.58.1-r1 —
Wolfi rolling wolfictl 0.27.5-r0 —
Wolfi rolling zarf 0.45.0-r3 —
Wolfi rolling zot 2.1.1-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/go-git/go-git/v4 >= 4.0.0 — GO-2025-3368
Go github.com/go-git/go-git/v5 < 5.13.0 5.13.0 GHSA-v725-9546-7q7m
Go gopkg.in/src-d/go-git.v4 >= 4.0.0, <= 4.13.1 — GHSA-v725-9546-7q7m
Go gopkg.in/src-d/go-git.v4 >= 4.0.0 — GO-2025-3368

Advisories 28

References