CVE-2022-26945: Command Injection
A flaw was found in go-getter. This flaw allows an attacker to misuse go-getter to execute commands on the host. This action may be possible when symlink processing and path traversal are allowed.
Other sources
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
HashiCorp go-getter before 2.0.2 allows Command Injection.
Reference: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for go-getter?
The vulnerability ID for go-getter is CVE-2022-26945.
What is the severity level of CVE-2022-26945?
The severity level of CVE-2022-26945 is critical with a CVSS score of 9.8.
What is affected by CVE-2022-26945?
HashiCorp go-getter versions up to 1.5.11 and 2.0.2 are affected by CVE-2022-26945.
How can an attacker exploit CVE-2022-26945?
An attacker can exploit CVE-2022-26945 by misusing go-getter to execute commands on the host.
How can I fix CVE-2022-26945?
To fix CVE-2022-26945, update HashiCorp go-getter to version 1.6.1 or 2.1.0.