Database/Control plane, storage & DevOps
Terraform (go-getter): Argument injection when go-getter shells out to Git for remote branch discovery
CVSS 9.8CVE-2024-3817Control plane, storage & DevOpscurated
Impact
Argument injection when go-getter shells out to Git for remote branch discovery -> RCE in the IaC runner
Who can reach it
Network (remote)
What to do
Control-plane: bump go-getter/Terraform in the CI runner image
References
Related entries
- Veeam Backup & Replication: Deserialization of untrusted dataCVE-2024-40711 · Veeam Backup & ReplicationCritical
- Fluent Bit: "Linguistic Lumberjack" - memory corruption parsing trace requests in the embedded HTTP serverCVE-2024-4323 · Fluent BitCritical
- Fortinet FortiManager: "FortiJump" - missing authentication in fgfmdCVE-2024-47575 · Fortinet FortiManagerCritical
- GitHub Enterprise Server: Forged SAML response with encrypted assertions enabledCVE-2024-4985 · GitHub Enterprise ServerCritical
- Linux NFS server (nfsd, laundromat vs free_stateid race): A race between the delegation laundromat and a client-issuedCVE-2024-50106 · Linux NFS server (nfsd, laundromat vs free_stateid race)Critical
- HPE Insight Remote Support (directory traversal to RCE): Directory traversal allowing unauthenticated remote codeCVE-2024-53676 · HPE Insight Remote Support (directory traversal to RCE)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.