Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/hashicorp/go-getter/s3/v2

4 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4
Registry
pkg.go.dev

Advisories 4

  • go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response…

    Affected: fixed in 2.1.0.

  • go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection…

    Affected: fixed in 2.1.0.

  • go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.

    Affected: fixed in 2.1.0.

  • go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.

    Affected: fixed in 2.1.0.