Lucene search
Veracode Vulnerability DatabaseVERACODE:39390HistoryFeb 23, 2023 - 8:59 a.m.
Denial Of Service (DoS)
2023-02-2308:59:18
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
15
denial of service
zip archive
recursion
zip bomb
vulnerability
software
0.001 Low
EPSS
Percentile
33.8%
github.com/hashicorp/go-getter is vulnerable to Denial of Service (DoS). The vulnerability is due to unbounded recursion when decompressing a ZIP archive, resulting in an application crash when decompressing a maliciously crafted archive, or “ZIP Bomb”.
References
discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
github.com/advisories/GHSA-jpxj-2jvg-6jv9
github.com/hashicorp/go-getter/commit/017a2ee8897ec08a291eadf4815c66c9d9fe6f58
github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc
Related
github
github
Data Amplification in HashiCorp go-getter
2023-02-16 21:30:28
cbl_mariner
cbl_mariner
CVE-2023-0475 affecting package k3s 1.24.12-2
2024-07-03 17:22:50
CVE-2023-0475 affecting package terraform 1.3.2-15
2024-07-03 17:22:50
CVE-2023-0475 affecting package packer for versions less than 1.8.7-1
2024-01-19 03:54:24
osv
osv
Data Amplification in HashiCorp go-getter
2023-02-16 21:30:28
Denial of service in github.com/hashicorp/go-getter/v2
2023-02-17 21:16:15
CVE-2023-0475
2023-02-16 19:15:13
nvd
nvd
CVE-2023-0475
2023-02-16 19:15:13
ubuntucve
ubuntucve
CVE-2023-0475
2023-02-16 00:00:00
debiancve
debiancve
CVE-2023-0475
2023-02-16 19:15:13
redhatcve
redhatcve
CVE-2023-0475
2023-02-17 12:29:15
prion
prion
Design/Logic Flaw
2023-02-16 19:15:00
cve
cve
CVE-2023-0475
2023-02-16 19:15:13
cvelist
cvelist
CVE-2023-0475 Go-Getter Vulnerable to Decompression Bombs
2023-02-16 18:35:37
redhat
redhat
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps
2024-03-27 20:12:33
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management
2024-02-28 21:45:52
Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps
2024-06-26 16:06:34