CVE-2022-30323: High severity HashiCorp go-getter vulnerability
A flaw was found in go-getter. Several vulnerabilities were identified in how go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service.
Other sources
go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.
HashiCorp go-getter through 2.0.2 does not safely perform downloads (issue 3 of 3).
References: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 https://github.com/hashicorp/go-getter/releases
— Red Hat
HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious HTTP responses.
— GitHub
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-30323?
CVE-2022-30323 is a vulnerability found in go-getter that allows an attacker to bypass certain configuration settings and may lead to a denial of service.
How does go-getter process HTTP responses?
Go-getter processes HTTP responses in a vulnerable way that can be exploited by attackers.
What can an attacker do with CVE-2022-30323?
An attacker can bypass certain configuration settings and potentially cause a denial of service.
How can the vulnerability in go-getter be fixed?
The vulnerability in go-getter can be fixed by updating to version 1.6.1 or higher.
Where can I find more information about CVE-2022-30323?
You can find more information about CVE-2022-30323 in the references provided.