GSA_kwCzR0hTQS1qcHhqLTJqdmctNmp2Oc4AAxsJ

Moderate EPSS: 0.00067% (0.21062 Percentile) EPSS:

Permalink JSON

Data Amplification in HashiCorp go-getter

Affected Packages	Affected Versions	Fixed Versions
go:github.com/hashicorp/go-getter/v2	>= 2.0.0, < 2.2.0	2.2.0
195 Dependent packages 234 Dependent repositories Affected Version Ranges All affected versions 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1 All unaffected versions 2.2.0, 2.2.1, 2.2.2, 2.2.3
go:github.com/hashicorp/go-getter	< 1.7.0	1.7.0
3,705 Dependent packages 6,872 Dependent repositories Affected Version Ranges All affected versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.5.10, 1.5.11, 1.6.0, 1.6.1, 1.6.2 All unaffected versions 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

References:

Identifiers

GHSA-jpxj-2jvg-6jv9

CVE-2023-0475

Risk

Severity

Moderate

EPSS

EPSS Percentage: 0.00067

EPSS Percentile: 0.21062

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Repository

https://github.com/hashicorp/go-getter

Date and time

Published

over 2 years ago

Updated

about 1 year ago

API

JSON

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Advisories