Package: golang-github-hashicorp-go-getter X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security
Hi, The following vulnerability was published for golang-github-hashicorp-go-getter. CVE-2024-3817[0]: | HashiCorp’s go-getter library is vulnerable to argument injection | when executing Git to discover remote branches. This vulnerability | does not affect the go-getter/v2 branch and package. https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-3817 https://www.cve.org/CVERecord?id=CVE-2024-3817 Please adjust the affected versions in the BTS as needed.
