CVE-2022-26945

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30321

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30321

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30321

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30321

CVE-2022-30321 affects HashiCorp go-getter up to 1.5.11 and 2.0.2, enabling arbitrary host access via path traversal, symlink processing, and command injection vulnerabilities. The issue is resolved in version 1.6.1 (and 2.1.0). Connected advisories (GHSA, OSV) corroborate unsafe download behavio...

CVE-2022-30322

CVE-2022-30322 affects the HashiCorp go-getter library (versions up to 1.5.11 and 2.0.2). The connected documents describe unsafe download behavior: protocol switching, endless redirects, and header-processing abuses enabling arbitrary host access, command injection, path traversal, and asymmetri...

CVE-2022-30322

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30322

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30322

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30323

go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30323

CVE-2022-30323 relates to the go-getter library (HashiCorp go-getter). Affected versions up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files due to unsafe download handling. Fixed in 1.6.1 and 2.1.0. Connected advisories (OSV/GHSA/GITHUB/Nessus) corroborate unsafe downloa...

CVE-2022-30323

go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0...

CVE-2022-30323

go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0...

HashiCorp go-getter 命令注入漏洞

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. A command injection vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the presence of a comman...

PT-2022-20064 · Hashicorp +1 · Go-Getter +1

Name of the Vulnerable Software and Affected Versions: HashiCorp go-getter versions 1.5.11 and earlier, 2.0.2 and earlier Description: The issue allows for asymmetric resource exhaustion when processing malicious HTTP responses. It also enables protocol switching, endless redirect, and...

PT-2022-20065 · Hashicorp +1 · Go-Getter +1

Name of the Vulnerable Software and Affected Versions: HashiCorp go-getter versions 1.5.11 and earlier HashiCorp go-getter versions 2.0.2 and earlier Description: The issue concerns the unsafe download handling in HashiCorp go-getter. Malicious HTTP responses can cause various misbehaviors,...

HashiCorp go-getter 输入验证错误漏洞

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...

HashiCorp go-getter 输入验证错误漏洞

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...

HashiCorp go-getter 命令注入漏洞

HashiCorp go-getter is a library for Go golang from HashiCorp, Inc. that is used to download files or directories from various sources using URLs as the primary form of input. A command injection vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the...

Nomad Impacted by go-getter Vulnerabilities

Summary Vulnerabilities were identified in the go-getter library that Nomad and Nomad Enterprise “Nomad” uses for its artifacts such that a specially crafted Nomad jobspec can be used for privilege escalation onto client agent hosts. This combined exposure, CVE-2022-30324, affects Nomad versions...