CVE-2024-6257

Publication date 25 June 2024

Last updated 24 June 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

8.4 · High

Score breakdown

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

Status

Package Ubuntu Release Status
golang-github-hashicorp-go-getter 25.04 plucky
Vulnerable
24.10 oracular
Vulnerable
24.04 LTS noble
Vulnerable
23.10 mantic Ignored end of life, was needs-triage
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
golang-github-jesseduffield-go-getter 25.04 plucky Not in release
24.10 oracular
Vulnerable
24.04 LTS noble
Vulnerable
23.10 mantic Ignored end of life, was needs-triage
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable

Severity score breakdown

Parameter Value
Base score 8.4 · High
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Scope Changed
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H