GHSA-27rq-4943-qcwp

Insertion of Sensitive Information into Log File in Hashicorp go-getter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-29810

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/go-getter	< 1.5.11	1.5.11

Details

As written in the advisory (Markdown source, shown as plain text).

The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-29810 advisory
https://github.com/hashicorp/go-getter/pull/348 web
https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc web
https://github.com/hashicorp/go-getter package
https://github.com/hashicorp/go-getter/releases/tag/v1.5.11 web
https://pkg.go.dev/vuln/GO-2022-0438 web