CVE-2025-0377: HashiCorp go-slug Vulnerable to Zip Slip Attack
First published: Tue Jan 21 2025(Updated: )
## Summary HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3. ## Background HashiCorp’s go-slug shared library offers functions for packing and unpacking Terraform Enterprise compatible slugs. Slugs are gzip compressed tar files containing Terraform configuration files. ## Details When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path traversal, allowing an attacker to write an arbitrary file during extraction. ## Remediation Consumers of the go-slug shared library should evaluate the risk associated with this issue in the context of their go-slug usage and upgrade go-slug to 0.16.3 or later.
Credit: security@hashicorp.com security@hashicorp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HashiCorp go-slug | ||
| go/github.com/hashicorp/go-slug | <0.16.3 | 0.16.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0377?
CVE-2025-0377 is classified as a medium severity vulnerability due to its potential for exploitation in zip-slip attacks.
How do I fix CVE-2025-0377?
To fix CVE-2025-0377, upgrade the go-slug library to version 0.16.3 or later.
What type of attack does CVE-2025-0377 involve?
CVE-2025-0377 involves a zip-slip style attack that can be triggered when extracting user-provided paths from tar entries.
Which versions of HashiCorp go-slug are affected by CVE-2025-0377?
All versions of HashiCorp go-slug prior to 0.16.3 are affected by CVE-2025-0377.
Who is the vendor for CVE-2025-0377?
The vendor for CVE-2025-0377 is HashiCorp, responsible for the go-slug library.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wpfp-cm49-9m9q
- alias/CVE-2025-0377
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/source
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- agent/author
- agent/tags
- collector/github-advisory
- vendor/hashicorp
- canonical/hashicorp go-slug
- package-manager/go