GitHub Advisoryadvisory · Go

GHSA-x24g-9w7v-vprh HashiCorp go-getter command injection

CRITICAL Published 2022-05-26 Modified 2022-08-11 Official page ↗
Aliases
CVE-2022-26945
Ecosystem
Go
Packages
github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/v2, github.com/hashicorp/go-getter/s3/v2, github.com/hashicorp/go-getter/gcs/v2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2022-06-01

Affected packages

• Go github.com/hashicorp/go-getter: < 1.6.1 → fixed in 1.6.1 • Go github.com/hashicorp/go-getter: >= 2.0.0, < 2.1.0 → fixed in 2.1.0 • Go github.com/hashicorp/go-getter/v2: < 2.1.0 → fixed in 2.1.0 • Go github.com/hashicorp/go-getter/s3/v2: < 2.1.0 → fixed in 2.1.0 • Go github.com/hashicorp/go-getter/gcs/v2: < 2.1.0 → fixed in 2.1.0

Description

HashiCorp go-getter before 2.0.2 allows Command Injection.

Related

Alias · CVE (1)

  • CVE-2022-26945 go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References