[pkg-go] Bug#1083184: golang-github-hashicorp-go-getter: CVE-2024-3817

[Moritz Mühlenhoff]

Package: golang-github-hashicorp-go-getter
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for golang-github-hashicorp-go-getter.

CVE-2024-3817[0]:
| HashiCorp’s go-getter library is vulnerable to argument injection
| when executing Git to discover remote branches.   This vulnerability
| does not affect the go-getter/v2 branch and package.

https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-3817
    https://www.cve.org/CVERecord?id=CVE-2024-3817

Please adjust the affected versions in the BTS as needed.