42 matches found
FreeBSD : terraform -- exclusion bypass in .terraformignore handling (4496ae0c-9d7d-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4496ae0c-9d7d-11f1-a655-3497f65b111b advisory. HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP...
Go-slug vulnerable to exclusion bypass in .terraformignore handling
Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...
terraform -- exclusion bypass in .terraformignore handling
HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP Terraform or Terraform Enterprise when a run is started. In go-slug before v0.18.3, matching of .terraformignore rules does not consistently treat canonically equivalent Unicode filenames as the sam...
CVE-2026-14978
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
CVE-2026-14978
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
EUVD-2026-63099
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
CVE-2026-14978
go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...
CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...
EUVD-2025-0202
Malicious code in bioql PyPI...
EUVD-2023-0600
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2020-29529
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific...
Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1
Summary This SB contains a list for all CVE's listed here - CVE-2022-36083, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166, CVE-2021-21797, CVE-2022-35941, CVE-2021-42248, CVE-2021-42836, CVE-2022-40186, CVE-2022-41316, CVE-2021-36090, CVE-2020-29529, CVE-2020-7219 fixed in 3.5.1 Vulnerability...
CVE-2025-0377
An archive extraction vulnerability was found in HashiCorp's go-slug library. When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path...
GO-2025-3413 HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug
HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug...
Relative Path Traversal
github.com/hashicorp/go-slug is vulnerable to Relative Path Traversal. The vulnerability is due to improper path validation when extracting user-provided paths from tar entries, allowing for directory traversal and potential overwriting of arbitrary files...
SUSE CVE-2025-0377
HashiCorp's go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry...
HashiCorp go-slug Vulnerable to Zip Slip Attack
Summary HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3. Background HashiCorp’s go-slug shared library offers functions for...
GHSA-WPFP-CM49-9M9Q HashiCorp go-slug Vulnerable to Zip Slip Attack
Summary HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3. Background HashiCorp’s go-slug shared library offers functions for...