CVE-2024-32478 Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files

Git Credential Manager GCM is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0...

CVE-2024-32478 Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files

Git Credential Manager GCM is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0...

Git Credential Manager 安全漏洞

Git Credential Manager GCM is a secure Git credential assistant open-sourced by Git Ecosystem. A security vulnerability exists in Git Credential Manager versions prior to 2.5.0 that stems from a Debian package that does not set root ownership on installed files, which allows a user on a multi-use...

PT-2024-24601 · Unknown · Git Credential Manager

Name of the Vulnerable Software and Affected Versions: Git Credential Manager GCM versions prior to 2.5.0 Description: The issue arises from the Debian package of Git Credential Manager GCM not setting root ownership on installed files prior to version 2.5.0. This allows a user on a multi-user...

NewStart CGSL CORE 5.04 / MAIN 5.04 : git Multiple Vulnerabilities (NS-SA-2024-0015)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has git packages installed that are affected by multiple vulnerabilities: - Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by...

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host...

GHSA-Q64H-39HV-4CF7 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host...

CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

DEBIAN-CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

UBUNTU-CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817

CVE-2024-3817: HashiCorp go-getter is vulnerable to argument injection when executing Git to discover remote branches. The description notes this affects the go-getter package (not the go-getter/v2 branch). The CVSS v3.1 base score is 9.8 (CRITICAL) with network attack vector, no privileges requi...

CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

Summary HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability, CVE-2024-3817, is fixed in go-getter 1.7.4. This vulnerability does not affect the go-getter/v2 branch and package. Background HashiCorp’s go-getter is a...

Biased ECDSA Nonce Generation

PuTTYis vulnerable to biased ECDSA nonce generation. The vulnerability is due to biased ECDSA nonce generation, allowing an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is particularly significant in scenarios where an adversary can re...

PT-2024-5223 · Go-Getter +2 · Go-Getter +2

Name of the Vulnerable Software and Affected Versions: go-getter versions prior to 1.7.4 go-getter/v2 branch and package are not affected Description: The go-getter library is vulnerable to argument injection when executing Git to discover remote branches. An attacker may format a Git URL in orde...

PuTTY < 0.81 Key Recovery Attack Vulnerability

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant...

PT-2024-24364 · Kohya Ss · Kohya Ss

Name of the Vulnerable Software and Affected Versions: Kohya ss versions prior to 23.1.5 Description: Kohya ss, a GUI for Kohya's Stable Diffusion trainers, is affected by a command injection issue in the git caption gui.py file. Recommendations: For versions prior to 23.1.5, update to version...

FreeBSD : PuTTY and embedders (f.i., filezilla) -- biased RNG with NIST P521/ecdsa-sha2-nistp521 signatures permits recovering private key (080936ba-fbb7-11ee-abc8-6960f2492b1d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 080936ba-fbb7-11ee-abc8-6960f2492b1d advisory. - In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a...