CVE-2024-6257: hashicorp go-getter Command Injection
CVSS: 8.8v3.1HighAnalyzed
AliasesUBUNTU-CVE-2024-6257DEBIAN-CVE-2024-6257CGA-247q-6jj9-hq4gCGA-26j8-5wv9-mh35CGA-2842-c9mv-hqqjCGA-2v5j-g6c6-3q62CGA-32pp-hc63-2rv8CGA-3c36-2j6x-92mxCGA-3cfq-5gw9-jmw6CGA-3h93-rg85-m283CGA-4jrf-rq9f-wm68CGA-54qp-vp93-wfw7CGA-752f-277x-vv5rCGA-7fqc-4wv4-x9j9CGA-7j73-87jq-m72wCGA-7xcm-vwm6-qwfwCGA-83q2-xcmp-3jmmCGA-88gj-whgh-37mvCGA-8pmf-932r-qp52CGA-8vvp-67xv-wx53CGA-9mhg-44fc-h8phCGA-cq94-g86j-7p3qCGA-fxfq-wwr4-rvgvCGA-g2fh-f4x2-f783CGA-gjq3-8h7q-vvpfCGA-j464-43h2-j4hcCGA-j689-cqc7-pfpvCGA-mwcp-mg85-86qwCGA-mxm2-xgjx-whqfCGA-q7h9-jcrg-chh2CGA-qh45-hvjj-p665CGA-qmqj-9mc3-2336CGA-qp7w-hm97-2v22CGA-v3qm-2wq4-fhvgCGA-v4fw-q4pf-mrhqCGA-v73p-wxjc-9vcrCGA-w6h3-qmx2-q8fqCGA-wcj4-259w-fp75CGA-x3jf-jgm8-wxxwCGA-xwv7-fw9c-59v6GHSA-xfhp-jf8p-mh5wGO-2024-2948openSUSE-SU-2024:14183-1openSUSE-SU-2024:14190-1CGA-6qqj-9vqq-r85xCGA-842f-p67m-rjq5CGA-c6rr-qfgg-8r4qCGA-g2h5-qjxr-4r5f
Published 25-06-2024Last modified 01-08-2024
Vulnerability summary
CVE-2024-6257 is a high (CVSS 8.8) Command Injection vulnerability in hashicorp go-getter. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.6% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.98%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 24OPENSUSE-SU-2024:0268-1OPENSUSE-SU-2024:0269-1CGA-22M6-C957-GM9JCGA-2H9P-9X34-5864CGA-2RF9-X5M2-8CMGCGA-2X8C-J6QQ-9CH3CGA-4PCX-4JFH-74CXCGA-7FRC-59MG-633VCGA-7GW8-4CW9-2FP5CGA-7RQ5-JPH4-8HG2CGA-9J65-GR8F-F2GMCGA-FJ5P-RF33-FQHFCGA-G2GW-MH57-3GFMCGA-G8HG-7GX4-5CCFCGA-GFPC-W452-J2H8CGA-GRWC-XWH5-VFHWCGA-H4R2-9H96-M8C3CGA-HF37-MXJW-6V76CGA-P3JV-W75P-9X47CGA-P58V-7JGP-WXGQCGA-RR8V-2X66-39G9CGA-V8XV-X639-QMVWCGA-WW4F-Q98M-79V5CGA-X3MP-JP2J-7H65
Timeline
- 25-06-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSources7 sources · 8.4–8.8
- CVE.orgCNA8.4HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.4HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · GoEcosystem advisory · calculated8.4HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated8.4HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.98%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
+0.01 pp
From 0.97% on 20-09-2026
20-09-202620-10-2026
EPSS score0.98%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard21 products
- conftest< 0.53.0-r1
- conftest-fips< 0.53.0-r1
- grype< 0.79.1-r1
- k9s< 0.32.5-r1
- kots< 1.109.14-r1
Wolfi19 products
- conftest< 0.53.0-r1
- grype< 0.79.1-r1
- k9s< 0.32.5-r1
- kots< 1.109.14-r1
- kots-compat< 1.109.14-r1
Hashicorp2 products
- go-getter< 1.7.5
- shared library< 1.7.4
Opensuse2 products
- conftest&distro=openSUSE Tumbleweed< 0.54.0-1.1
- trivy&distro=openSUSE Tumbleweed< 0.53.0-1.1
Ubuntu2 products
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
- golang-github-jesseduffield-go-getterAll versions (No fix recorded)
Debian1 product
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
Github.com/hashicorp1 product
- go-getter< 1.7.5
7 vendors · 48 products
