Lucene search
GoogleOSV:GO-2023-1578HistoryFeb 17, 2023 - 9:16 p.m.
Denial of service in github.com/hashicorp/go-getter/v2
2023-02-1721:16:15
Google
osv.dev
15
hashicorp
go-getter
vulnerability
decompression bombs
memory consumption
denial-of-service
github
software
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
33.8%
HashiCorp go-getter is vulnerable to decompression bombs. This can lead to excessive memory consumption and denial-of-service attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/hashicorp/go-getter/v2 | lt | 2.2.0 | |
| github.com/hashicorp/go-getter/v2 | ge | 2.0.0 | |
| github.com/hashicorp/go-getter | lt | 1.7.0 |
Related
github
github
Data Amplification in HashiCorp go-getter
2023-02-16 21:30:28
cbl_mariner
cbl_mariner
CVE-2023-0475 affecting package k3s 1.24.12-2
2024-07-03 17:22:50
CVE-2023-0475 affecting package terraform 1.3.2-15
2024-07-03 17:22:50
CVE-2023-0475 affecting package packer for versions less than 1.8.7-1
2024-01-19 03:54:24
osv
osv
Data Amplification in HashiCorp go-getter
2023-02-16 21:30:28
CVE-2023-0475
2023-02-16 19:15:13
ubuntucve
ubuntucve
CVE-2023-0475
2023-02-16 00:00:00
veracode
veracode
Denial Of Service (DoS)
2023-02-23 08:59:18
debiancve
debiancve
CVE-2023-0475
2023-02-16 19:15:13
nvd
nvd
CVE-2023-0475
2023-02-16 19:15:13
redhatcve
redhatcve
CVE-2023-0475
2023-02-17 12:29:15
prion
prion
Design/Logic Flaw
2023-02-16 19:15:00
cve
cve
CVE-2023-0475
2023-02-16 19:15:13
cvelist
cvelist
CVE-2023-0475 Go-Getter Vulnerable to Decompression Bombs
2023-02-16 18:35:37
redhat
redhat
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps
2024-03-27 20:12:33
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management
2024-02-28 21:45:52
Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps
2024-06-26 16:06:34
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
33.8%
Related for OSV:GO-2023-1578