Most recent entries from all

ALSA-2025:0401 — Important: grafana security update

Affected: AlmaLinux:8: grafana, AlmaLinux:8: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* go-git: argument injection via the URL field (CVE-2025-21613) * go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00210

certfr-2025-avi-0337 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0337

EUVD-2026-209116

fkie_cve-2025-21613

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

GHSA-v725-9546-7q7m — go-git has an Argument Injection via the URL field

Affected: Go: gopkg.in/src-d/go-git.v4, Go: github.com/go-git/go-git/v5

### Impact An argument injection vulnerability was discovered in `go-git` versions prior to `v5.13`.

Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to [git-upload-pack flags](https://git-scm.com/docs/git-upload-pack). This only happens when the `file` transport protocol is being used, as that is the only protocol that shells out to `git` binaries.

### Affected versions Users running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.

### Workarounds In cases where a bump to the latest version of `go-git` is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.

## Credit Thanks to @vin01 for responsibly disclosing this vulnerability to us.

msrc_CVE-2025-21613 — go-git has an Argument Injection via the URL field

msrc_CVE-2025-21613

openSUSE-SU-2025:0056-1 — Security update for trivy

Security update for trivy

RHSA-2024:6121 — Red Hat Security Advisory: OpenShift Container Platform 4.18.1 security and extras update

helm: shows secrets with --dry-run option in clear text PostCSS: Improper input validation in PostCSS cross-spawn: regular expression denial of service golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html body-parser: Denial of Service Vulnerability in body-parser dompurify: DOMPurify vulnerable to tampering by prototype pollution path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x nanoid: nanoid mishandles non-integer values jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method go-git: argument injection via the URL field go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies

SUSE-SU-2025:0060-1 — Security update for govulncheck-vulndb

Security update for govulncheck-vulndb

UBUNTU-CVE-2025-21613

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git

WID-SEC-W-2025-0123 — Red Hat Enterprise Linux und and OpenShift (go-git): Mehrere Schwachstellen

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Grafana Komponente ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.