GitHub Advisoryadvisory · Go

GHSA-fcgg-rvwg-jv58 HashiCorp go-getter unsafe downloads

HIGH Published 2022-05-26 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-30321
Ecosystem
Go
Packages
github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/v2, github.com/hashicorp/go-getter/s3/v2, github.com/hashicorp/go-getter/gcs/v2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Reviewed
2022-06-01

Affected packages

• Go github.com/hashicorp/go-getter: < 1.6.1 → fixed in 1.6.1 • Go github.com/hashicorp/go-getter: >= 2.0.0, < 2.1.0 → fixed in 2.1.0 • Go github.com/hashicorp/go-getter/v2: < 2.1.0 → fixed in 2.1.0 • Go github.com/hashicorp/go-getter/s3/v2: < 2.1.0 → fixed in 2.1.0 • Go github.com/hashicorp/go-getter/gcs/v2: < 2.1.0 → fixed in 2.1.0

Description

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.

Related

Alias · CVE (1)

  • CVE-2022-30321 go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection… vulnerability

References