CVE-2022-29810: Medium severity HashiCorp go-getter vulnerability
A flaw was found in go-getter, where the go-getter library can write SSH credentials into its log file. This flaw allows a local user with access to read log files to read sensitive credentials, which may lead to privilege escalation or account takeover.
Other sources
The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.
https://github.com/hashicorp/go-getter/pull/348 https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
— Red Hat
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-29810?
CVE-2022-29810 is a vulnerability in the Hashicorp go-getter library before 1.5.11 that does not redact an SSH key from a URL query parameter.
What is the severity of CVE-2022-29810?
The severity of CVE-2022-29810 is medium with a severity value of 5.1.
How does CVE-2022-29810 affect the software?
CVE-2022-29810 affects the Hashicorp go-getter library before 1.5.11 and the HashiCorp go-getter package with versions up to 1.5.11.
What is the impact of CVE-2022-29810?
The impact of CVE-2022-29810 is that a local user with access to read log files may be able to read sensitive credentials, potentially leading to privilege escalation or account takeover.
How can CVE-2022-29810 be fixed?
To fix CVE-2022-29810, update the Hashicorp go-getter library to version 1.5.11 or later.