CVE-2022-30321: Path Traversal
A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service.
Other sources
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
HashiCorp go-getter through 2.0.2 does not safely perform downloads (issue 1 of 3).
References: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 https://github.com/hashicorp/go-getter/releases
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-30321?
CVE-2022-30321 is a vulnerability in the go-getter library that allows arbitrary host access via go-getter path traversal symlink.
What is the severity level of CVE-2022-30321?
The severity level of CVE-2022-30321 is high with a score of 8.6.
How does CVE-2022-30321 impact go-getter?
CVE-2022-30321 may lead to a denial of service by allowing attackers to bypass certain configuration settings.
Which versions of go-getter are affected by CVE-2022-30321?
Versions up to and including 1.5.11 and version 2.0.2 of go-getter are affected by CVE-2022-30321.
How can I fix CVE-2022-30321?
To fix CVE-2022-30321, upgrade to version 1.6.1 for versions up to 1.5.11, or upgrade to version 2.1.0 for version 2.0.2.