~ / search / GHSA-fcgg-rvwg-jv58

GHSA-fcgg-rvwg-jv58

HashiCorp go-getter unsafe downloads

Source: GitHub Advisory Database (reviewed) High CVE-2022-30321

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/go-getter < 1.6.1 1.6.1
Go github.com/hashicorp/go-getter >= 2.0.0, < 2.1.0 2.1.0
Go github.com/hashicorp/go-getter/v2 < 2.1.0 2.1.0
Go github.com/hashicorp/go-getter/s3/v2 < 2.1.0 2.1.0
Go github.com/hashicorp/go-getter/gcs/v2 < 2.1.0 2.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.

References

External links from the advisory. They lead to third-party sites.