Read the docs
TI-2023-27070 Aliases CVE-2023-49569GHSA-449p-3h89-pw88

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

Priority MEDIUM 52CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 20 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0151 74th percentileScored 2026-11-07
Fix Partial github.com/go-git/go-git/v5 (Go): 5.11.0Red Hat: 31 advisoriesRed Hat: 20 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-gitgo-git5.11.0—No fix listedCNA
—github.com/go-git/go-git/v5 (Go)5.0.0 to before 5.11.05.11.0Patch availableGHSA-449p-3h89-pw88
—gopkg.in/src-d/go-git.v4 (Go)4.0.0 – 4.13.1—No fix listedGHSA-449p-3h89-pw88
  • go-git Vendorgo-git Affected 5.11.0 Fixed in — No fix listed CNA
  • github.com/go-git/go-git/v5 (Go) Vendor— Affected 5.0.0 to before 5.11.0 Fixed in 5.11.0 Patch available GHSA-449p-3h89-pw88
  • gopkg.in/src-d/go-git.v4 (Go) Vendor— Affected 4.0.0 – 4.13.1 Fixed in — No fix listed GHSA-449p-3h89-pw88

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*4.0.0 to before 5.11.0Vulnerablego-git
  • cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:* Versions 4.0.0 to before 5.11.0 Vulnerable ·go-git

Remediation

  • Fix · GHSA-449p-3h89-pw88 github.com/go-git/go-git/v5 (Go) Fixed in 5.11.0 Advisory →

Red Hat 31 advisories

  • RHSA-2024:8425 Released 2024-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.15.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2024:6221 Released 2024-09-03 · Red Hat rating Critical
    The Red Hat OpenShift Builds 1.1.0 General Availability
    • Builds for Red Hat OpenShift
  • RHSA-2024:5013 Released 2024-08-05 · Red Hat rating Critical
    The Red Hat OpenShift Builds Client 1.1.0 General Availability
    • Builds for Red Hat OpenShift 1.1.1 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel9
Show 28 more Red Hat advisories
  • RHSA-2024:0041 Released 2024-06-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:0040 Released 2024-06-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.0 security and extras update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-ansible-operator, openshift4/ose-aws-efs-csi-driver-container-rhel9, openshift4/ose-cloud-event-proxy-rhel9 +11
  • RHSA-2024:4118 Released 2024-06-26 · Red Hat rating Moderate
    Red Hat Ceph Storage 5.3 security, bug fix, and enhancement update
    • Red Hat Ceph Storage 5.3 MON ceph-2:16.2.10-266.el8cp, ceph-base-2:16.2.10-266.el8cp, ceph-common-2:16.2.10-266.el8cp +30
    • Red Hat Ceph Storage 5.3 OSD ceph-2:16.2.10-266.el8cp, ceph-base-2:16.2.10-266.el8cp, ceph-common-2:16.2.10-266.el8cp +20
    • Red Hat Ceph Storage 5.3 Tools ceph-2:16.2.10-266.el8cp, ceph-2:16.2.10-266.el9cp, ceph-ansible-6.0.28.8-1.el8cp +47
  • RHSA-2024:3925 Released 2024-06-14 · Red Hat rating Critical
    Red Hat Ceph Storage 7.1 security, enhancements, and bug fix update
    • Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-194.el8cp, ceph-2:18.2.1-194.el9cp, ceph-base-2:18.2.1-194.el8cp +47
  • RHSA-2024:2047 Released 2024-05-02 · Red Hat rating Important
    OpenShift Container Platform 4.13.41 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/kubevirt-csi-driver-rhel8, openshift4/oc-mirror-plugin-rhel8, openshift4/ose-cluster-monitoring-operator +1
  • RHSA-2024:2633 Released 2024-05-01 · Red Hat rating Important
    updated rhceph-6.1 container image
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2024:2631 Released 2024-05-01 · Red Hat rating Critical
    Red Hat Ceph Storage 6.1 security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools ceph-2:17.2.6-216.el8cp, ceph-2:17.2.6-216.el9cp, ceph-base-2:17.2.6-216.el8cp +47
  • RHSA-2024:1891 Released 2024-04-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:1896 Released 2024-04-25 · Red Hat rating Important
    OpenShift Container Platform 4.12.56 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:1557 Released 2024-03-28 · Red Hat rating Critical
    Errata Advisory for Red Hat OpenShift Builds 1.0.1
    • Builds for Red Hat OpenShift 1.0 openshift-builds/openshift-builds-controller-rhel8, openshift-builds/openshift-builds-git-cloner-rhel8, openshift-builds/openshift-builds-image-bundler-rhel8 +5
  • RHSA-2024:1549 Released 2024-03-27 · Red Hat rating Critical
    ACS 4.3 enhancement and security update
    • RHACS 4.3 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +8
  • RHSA-2024:1052 Released 2024-03-06 · Red Hat rating Critical
    OpenShift Container Platform 4.12.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-oauth-apiserver-rhel8, openshift4/ose-olm-rukpak-rhel8
  • RHSA-2023:7198 Released 2024-02-27 · Red Hat rating Critical
    OpenShift Container Platform 4.15.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2023:7197 Released 2024-02-27 · Red Hat rating Critical
    OpenShift Container Platform 4.15.0 security and extras update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-ansible-operator, openshift4/ose-clusterresourceoverride-rhel9, openshift4/ose-clusterresourceoverride-rhel9-operator +7
  • RHSA-2024:0989 Released 2024-02-26 · Red Hat rating Critical
    Red Hat Multicluster GlobalHub 1.0.2 bug fixes and security updates
    • multicluster-globalhub 1.0 for RHEL 8 multicluster-globalhub/multicluster-globalhub-grafana-rhel8
  • RHSA-2024:0833 Released 2024-02-21 · Red Hat rating Critical
    OpenShift Container Platform 4.12.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-alibaba-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator, openshift4/ose-operator-lifecycle-manager +4
  • RHSA-2024:0845 Released 2024-02-21 · Red Hat rating Critical
    OpenShift Container Platform 4.13.34 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-operator-lifecycle-manager, openshift4/ose-operator-registry
  • RHSA-2024:0832 Released 2024-02-21 · Red Hat rating Critical
    OpenShift Container Platform 4.12.50 security and extras update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-operator-sdk-rhel8
  • RHSA-2024:0880 Released 2024-02-20 · Red Hat rating Critical
    Release of OpenShift Serverless Client kn 1.31.1 security update
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.10.0-6.el8
  • RHSA-2024:0843 Released 2024-02-15 · Red Hat rating Critical
    Release of OpenShift Serverless 1.31.1
    • Red Hat OpenShift Serverless 1.31 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-swf-builder-rhel8 +37
  • RHSA-2024:0741 Released 2024-02-14 · Red Hat rating Critical
    OpenShift Container Platform 4.13.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/egress-router-cni-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator +3
  • RHSA-2024:0740 Released 2024-02-14 · Red Hat rating Critical
    OpenShift Container Platform 4.13.33 security and extras update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-operator-sdk-rhel8
  • RHSA-2024:0735 Released 2024-02-13 · Red Hat rating Critical
    OpenShift Container Platform 4.14.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console, openshift4/ose-olm-rukpak-rhel8
  • RHSA-2024:0642 Released 2024-02-07 · Red Hat rating Critical
    OpenShift Container Platform 4.14.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-cluster-api-controllers-rhel8, openshift4/ose-cluster-api-rhel8 +7
  • RHSA-2024:0641 Released 2024-02-07 · Red Hat rating Critical
    OpenShift Container Platform 4.14.11 security and extras update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-kubernetes-nmstate-handler-rhel9 +1
  • RHSA-2024:0692 Released 2024-02-05 · Red Hat rating Critical
    Errata Advisory for Red Hat OpenShift GitOps 1.10.2 security update
    • Red Hat OpenShift GitOps 1.10 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6
  • RHSA-2024:0691 Released 2024-02-05 · Red Hat rating Critical
    Errata Advisory for Red Hat OpenShift GitOps v1.9.4 security update
    • Red Hat OpenShift GitOps 1.9 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 +6
  • RHSA-2024:0298 Released 2024-01-18 · Red Hat rating Critical
    Red Hat Advanced Cluster Management 2.9.2 security and bug fix container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/multicluster-operators-subscription-rhel8

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Data Science (RHODS)AffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Will not fix
Builds for Red Hat OpenShiftFixed RHSA-2024:6221
Builds for Red Hat OpenShift 1.0Fixed RHSA-2024:1557
Builds for Red Hat OpenShift 1.1.1Fixed RHSA-2024:5013
RHACS 4.3 for RHEL 8Fixed RHSA-2024:1549
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8Fixed RHSA-2024:0298
Red Hat Ceph Storage 5.3 MONFixed RHSA-2024:4118
Red Hat Ceph Storage 5.3 OSDFixed RHSA-2024:4118
Red Hat Ceph Storage 5.3 ToolsFixed RHSA-2024:4118
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2024:2633
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2024:3925
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:0832, RHSA-2024:0833, RHSA-2024:1052, RHSA-2024:1896
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:0740, RHSA-2024:0741, RHSA-2024:0845, RHSA-2024:2047
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:0641, RHSA-2024:0642, RHSA-2024:0735, RHSA-2024:1891
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2023:7197, RHSA-2023:7198, RHSA-2024:8425
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0040, RHSA-2024:0041
Red Hat OpenShift GitOps 1.10Fixed RHSA-2024:0692
Red Hat OpenShift GitOps 1.9Fixed RHSA-2024:0691
Red Hat OpenShift Serverless 1.0Fixed RHSA-2024:0880
Red Hat OpenShift Serverless 1.31Fixed RHSA-2024:0843
multicluster-globalhub 1.0 for RHEL 8Fixed RHSA-2024:0989
Not affected: 16 products
  • Builds for Red Hat OpenShift 1.1.1
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • Red Hat Ceph Storage 7.1 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • multicluster-globalhub 1.0 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49569
  2. 2026-10-03 Alias added: GHSA-449p-3h89-pw88

References

Advisory 2

Other 1

  • TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
  • TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
  • TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
  • TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
  • TI-2026-32877 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVSS 4.0HIGH 7.0
  • TI-2026-33320 go-git: Crafted repositories may modify main and submodule .git directories CVSS 3.1MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences