Update module github.com/hashicorp/go-getter to v1.7.5 [SECURITY]

[renovate-coveooss]

Jira: DT-4929

This PR contains the following updates:

Package	Type	Update	Change
github.com/hashicorp/go-getter	require	patch	v1.7.3 -> v1.7.5

GitHub Vulnerability Alerts

CVE-2024-3817

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.

CVE-2024-6257

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .

An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

---

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter)

v1.7.5

Compare Source

What's Changed

• Prevent Git Config Alteration on Git Update by @​dduzgun-security in https://github.com/hashicorp/go-getter/pull/497

New Contributors

• @​dduzgun-security made their first contribution in https://github.com/hashicorp/go-getter/pull/497

Full Changelog: hashicorp/go-getter@v1.7.4...v1.7.5

v1.7.4

Compare Source

What's Changed

• Escape user-provided strings in git commands https://github.com/hashicorp/go-getter/pull/483
• Fixed a bug in .netrc handling if the file does not exist https://github.com/hashicorp/go-getter/pull/433

Full Changelog: hashicorp/go-getter@v1.7.3...v1.7.4

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/Toronto, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.