CVE catalog

CVE-2025-21613

go-git vulnerabilities

Severity: High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jan 6, 2025, 4:13:10 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.28% · Oct 25, 2026

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-github-go-git-go-git	sid	`5.19.2-2`	fixed
Debian	golang-github-go-git-go-git	forky	`5.19.2-2`	fixed
Debian	golang-github-go-git-go-git	trixie	`5.14.0-1`	fixed
Debian	golang-github-go-git-go-git	bookworm	`5.4.2-3`	vulnerable
Ubuntu	golang-github-go-git-go-git	noble	Not reported	vulnerable
Ubuntu	golang-github-go-git-go-git	noble	`5.4.2-4ubuntu0.24.04.3+esm2`	fixed
Ubuntu	go-git	noble	`5.4.2-4ubuntu0.24.04.3+esm2`	fixed
Ubuntu	golang-github-go-git-go-git-dev	noble	`5.4.2-4ubuntu0.24.04.3+esm2`	fixed
Opensuse	rz-pm	tumbleweed	`0.3.3+git~14~gcee0d0d-1.1`	fixed
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-3build1`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4ubuntu0.24.04.1`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4ubuntu0.24.04.2`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4ubuntu0.24.04.2+esm1`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4ubuntu0.24.04.3`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4ubuntu0.24.04.3+esm1`	vulnerable
Ubuntu	golang-github-go-git-go-git	pro	`5.4.2-4ubuntu0.24.04.3+esm2`	fixed
Opensuse	amazon-ssm-agent	tumbleweed	`3.3.1611.0-1.1`	fixed
Opensuse	grafana	tumbleweed	`11.3.0-5.1`	fixed
Opensuse	brise	tumbleweed	`20230603+git.5fdd2d6-5.1`	fixed
Opensuse	govulncheck-vulndb	tumbleweed	`0.0.20250108T191942-1.1`	fixed
Suse	amazon-ssm-agent	linux enterprise module for public cloud 15 sp3	`3.3.1611.0-150000.5.20.1`	fixed
Suse	amazon-ssm-agent	linux enterprise module for public cloud 15 sp4	`3.3.1611.0-150000.5.20.1`	fixed
Suse	amazon-ssm-agent	linux enterprise module for public cloud 15 sp5	`3.3.1611.0-150000.5.20.1`	fixed
Suse	amazon-ssm-agent	linux enterprise module for public cloud 15 sp6	`3.3.1611.0-150000.5.20.1`	fixed
Opensuse	amazon-ssm-agent	leap 15.6	`3.3.1611.0-150000.5.20.1`	fixed
Suse	amazon-ssm-agent	linux enterprise module for public cloud 12	`3.3.1611.0-4.36.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-github-go-git-go-git	source	sid	`5.13.2-1`	not yet assigned	Not reported	[1092678]
Debian	golang-github-go-git-go-git	source	forky	`5.13.2-1`	not yet assigned	Not reported	[1092678]
Debian	golang-github-go-git-go-git	source	trixie	`5.13.2-1`	not yet assigned	Not reported	[1092678]
Debian	golang-github-go-git-go-git	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1092678]
Ubuntu	golang-github-go-git-go-git	deb	noble	`5.4.2-4ubuntu0.24.04.3+esm2`	Not reported	Not reported	Not reported
Ubuntu	go-git	deb	noble	`5.4.2-4ubuntu0.24.04.3+esm2`	Not reported	Not reported	Not reported
Ubuntu	golang-github-go-git-go-git-dev	deb	noble	`5.4.2-4ubuntu0.24.04.3+esm2`	Not reported	Not reported	Not reported
Opensuse	rz-pm	rpm	tumbleweed	`0.3.3+git~14~gcee0d0d-1.1`	Not reported	OPENSUSE-SU-2025:15438-1	Not reported
Ubuntu	golang-github-go-git-go-git	deb	pro	`5.4.2-4ubuntu0.24.04.3+esm2`	Not reported	UBUNTU-CVE-2025-21613	Not reported
Opensuse	amazon-ssm-agent	rpm	tumbleweed	`3.3.1611.0-1.1`	Not reported	OPENSUSE-SU-2025:14658-1	Not reported
Opensuse	grafana	rpm	tumbleweed	`11.3.0-5.1`	Not reported	OPENSUSE-SU-2025:14654-1	Not reported
Opensuse	brise	rpm	tumbleweed	`20230603+git.5fdd2d6-5.1`	Not reported	OPENSUSE-SU-2025:14752-1	Not reported
Opensuse	govulncheck-vulndb	rpm	tumbleweed	`0.0.20250108T191942-1.1`	Not reported	OPENSUSE-SU-2025:14624-1	Not reported
Suse	amazon-ssm-agent	rpm	linux enterprise module for public cloud 15 sp3	`3.3.1611.0-150000.5.20.1`	Not reported	SUSE-SU-2025:0277-1	Not reported
Suse	amazon-ssm-agent	rpm	linux enterprise module for public cloud 15 sp4	`3.3.1611.0-150000.5.20.1`	Not reported	SUSE-SU-2025:0277-1	Not reported
Suse	amazon-ssm-agent	rpm	linux enterprise module for public cloud 15 sp5	`3.3.1611.0-150000.5.20.1`	Not reported	SUSE-SU-2025:0277-1	Not reported
Suse	amazon-ssm-agent	rpm	linux enterprise module for public cloud 15 sp6	`3.3.1611.0-150000.5.20.1`	Not reported	SUSE-SU-2025:0277-1	Not reported
Opensuse	amazon-ssm-agent	rpm	leap 15.6	`3.3.1611.0-150000.5.20.1`	Not reported	SUSE-SU-2025:0277-1	Not reported
Suse	amazon-ssm-agent	rpm	linux enterprise module for public cloud 12	`3.3.1611.0-4.36.1`	Not reported	SUSE-SU-2025:0191-1	Not reported

[Debian bug #1092678]

Notes

[bookworm] golang-github-go-git-go-git: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[go-git]Affected
Source package: [golang-github-go-git-go-git]
Details (2)
- 5.4.2-3+b7 · amd64 · bookworm
  Affected
  usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
- 5.4.2-3+b7 · arm64 · bookworm
  Affected
  usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
[golang-github-go-git-go-git-dev]Affected
Source package: [golang-github-go-git-go-git]
Details (2)
- 5.4.2-3 · all · bookworm
  Affected
  usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12
- 5.4.2-3 · all · bookworm
  Affected
  usn · golang-github-go-git-go-git · debian · bookworm; usn · golang-github-go-git-go-git · debian · 12

[openSUSE Tumbleweed]

[rime-schema-all]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-array]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-bopomofo]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-cangjie]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-cantonese]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-combo-pinyin]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-custom]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-default]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-double-pinyin]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-emoji]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-emoji-cantonese]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-essay]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-essay-simp]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-extra]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-ipa]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-luna-pinyin]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-middle-chinese]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed
[rime-schema-pinyin-simp]Unknown
Source package: [brise]
Details (1)
- 20250315-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20230603+git.5fdd2d6-5.1
  Version impact unknown
  usn · brise · opensuse · tumbleweed

Next results

Observed: Oct 26, 2026, 11:39:56 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]