hashicorp go-getter vulnerabilities and exploits

(subscribe to this query)

668

VMScore

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

Hashicorp Go-getter 2.0.2 Hashicorp Go-getter

668

VMScore

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Hashicorp Go-getter 2.0.2 Hashicorp Go-getter

1 Github repository

NA

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Hashicorp Go-getter Hashicorp Go-getter 2.1.1

668

VMScore

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.

Hashicorp Go-getter 2.0.2 Hashicorp Go-getter

668

VMScore

go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.

Hashicorp Go-getter 2.0.2 Hashicorp Go-getter

187

VMScore

The Hashicorp go-getter library prior to 1.5.11 does not redact an SSH key from a URL query parameter.

Hashicorp Go-getter

668

VMScore

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.

Hashicorp Nomad 1.3.0 Hashicorp Nomad

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook