CVE-2022-30322: Path Traversal
A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service.
Other sources
go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.
HashiCorp go-getter through 2.0.2 does not safely perform downloads (issue 2 of 3).
References: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 https://github.com/hashicorp/go-getter/releases
— Red Hat
HashiCorp go-getter through 2.0.2 does not safely perform downloads. Arbitrary host access was possible via go-getter path traversal, symlink processing, and command injection flaws.
— GitHub
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-30322.
What is the severity of CVE-2022-30322?
The severity of CVE-2022-30322 is high with a CVSS score of 8.6.
What software versions are affected by CVE-2022-30322?
Versions up to 1.5.11 and 2.0.2 of go-getter are affected by CVE-2022-30322.
How can an attacker exploit CVE-2022-30322?
An attacker can exploit CVE-2022-30322 by bypassing certain configuration settings, leading to a denial of service.
Where can I find more information about CVE-2022-30322?
You can find more information about CVE-2022-30322 at the following references: [link1], [link2], [link3].