HashiCorp go-getter 安全漏洞

HashiCorp go-getter is a library for Go golang from HashiCorp, USA, for downloading files or directories from various sources using URLs as the primary form of input. A security vulnerability exists in HashiCorp go-getter version 1.x prior to 1.7.0 and version 2.x prior to 2.2.0, which stems from...

PT-2023-16290 · Hashicorp +1 · Go-Getter +1

Name of the Vulnerable Software and Affected Versions: HashiCorp go-getter versions 1.6.2 and earlier, 2.1.1 and earlier Description: The issue concerns decompression bombs, which can lead to excessive memory consumption and denial-of-service attacks. Recommendations: For versions 1.6.2 and...

SUSE CVE-2022-29810

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

go-getter vulnerable to denial of service via malicious compressed archive

Summary HashiCorp’s go-getter library up to 1.6.2 and 2.1.1 is vulnerable to denial of service via a malicious compressed archive. This vulnerability CVE-2023-0475 was fixed in go-getter 1.7.0 and 2.2.0. Background HashiCorp’s go-getter is a Go library for downloading files or directories from...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.8.53 bug fix and security update

Red Hat OpenShift Container Platform release 4.8.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.8. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.36 security update

Red Hat OpenShift Container Platform release 4.10.36 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.8.49 security update

Red Hat OpenShift Container Platform release 4.8.49 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.31 security update

Red Hat OpenShift Container Platform release 4.10.31 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.30 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

The vulnerability of the go-getter library, related to the lack of measures to cleanse input data, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the go-getter library is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Important: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 Train director operator containers, with several Important security fixes, are available for technology preview. Release osp-director-operator images Security Fixes: go-getter: unsafe download issue 1 of 3 Important CVE-2022-30321 go-getter: unsafe download issue 2...

The vulnerability of the Nomad application orchestrator’s go-getter library allows a hacker to elevate their privileges.

The vulnerability of the Nomad application’s go-getter orchestrator library is related to deficiencies in access control when using the artifact stanza structure. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.5.0 is now generally available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2022-30323

A flaw was found in go-getter. Several vulnerabilities were identified in how go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. Mitigation The fix...

CVE-2022-30322

A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. Mitigation The fix...

CVE-2022-30321

A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. Mitigation The fix...

CVE-2022-26945

A flaw was found in go-getter. This flaw allows an attacker to misuse go-getter to execute commands on the host. This action may be possible when symlink processing and path traversal are allowed. Mitigation The fix includes new configuration options to help limit the security exposure and have...

GHSA-526X-RM7J-V389 Privilege escalation in Hashicorp Nomad

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1...

Privilege escalation in Hashicorp Nomad

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1...

CVE-2022-30324

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1...