CVE-2023-0475 Go-Getter Vulnerable to Decompression Bombs

2023-02-1618:35:37

CWE-409

HashiCorp

www.cve.org

cve-2023-0475

go-getter

vulnerable

decompression bombs

hashicorp

4.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

33.8%

JSON

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "go-getter",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "repo": "https://github.com/hashicorp/go-getter",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "1.6.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "2.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]