CVEvulnerability
CVE-2020-29529
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-12-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-22, CWE-59
Description
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.
Affected configurations
• hashicorp go-slug (< 0.5.0)
Related
References
- https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0 Patch, Release Notes, Third Party Advisory
- https://github.com/hashicorp/go-slug/pull/12 Patch, Third Party Advisory
- https://github.com/hashicorp/go-slug/releases/tag/v0.5.0 Release Notes, Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug Exploit, Third Party Advisory
- https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0 Patch, Release Notes, Third Party Advisory
- https://github.com/hashicorp/go-slug/pull/12 Patch, Third Party Advisory
- https://github.com/hashicorp/go-slug/releases/tag/v0.5.0 Release Notes, Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug Exploit, Third Party Advisory