Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/hashicorp/go-getter/v2

5 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 medium
Registry
pkg.go.dev

Advisories 5

  • CVE-2023-0475Medium 4.2

    Go-Getter Vulnerable to Decompression Bombs

    Affected: from 2.0.0, fixed in 2.2.0.

  • go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response…

    Affected: fixed in 2.1.0.

  • go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection…

    Affected: fixed in 2.1.0.

  • go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.

    Affected: fixed in 2.1.0.

  • go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.

    Affected: fixed in 2.1.0.