github.com/hashicorp/go-getter/v2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Medium 4.2

CVE-2023-0475

Go-Getter Vulnerable to Decompression Bombs

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

HashiCorp go-getter packer terraform Debian Ubuntu Azure Linux Go

Feb 16, 2023
High 8.6

CVE-2022-26945

HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

golang-github-hashicorp-go-getter golang-github-hashicorp-go-getter golang-github-jesseduffield-go-getter github.com/hashicorp/go-getter Debian Ubuntu Go

May 25, 2022