CVE-2022-30321

Опубликовано: 25 мая 2022

Источник: nvd

CVSS3: 8.6

CVSS2: 7.5

EPSS Низкий

Описание

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

Ссылки

https://discuss.hashicorp.com
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
Vendor Advisory
https://github.com/hashicorp/go-getter/releases
Release Notes
Third Party Advisory
https://discuss.hashicorp.com
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
Vendor Advisory
https://github.com/hashicorp/go-getter/releases
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*

Версия до 1.5.11 (включая)

cpe:2.3:a:hashicorp:go-getter:2.0.2:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01225

Низкий

8.6 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2022-30321

CVSS3: 8.6

ubuntu

больше 3 лет назад

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

CVE-2022-30321

CVSS3: 8.6

redhat

больше 3 лет назад

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

CVE-2022-30321

CVSS3: 8.6

debian

больше 3 лет назад

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go- ...

GHSA-fcgg-rvwg-jv58

CVSS3: 8.6

github

больше 3 лет назад

HashiCorp go-getter unsafe downloads

EPSS

Процентиль: 79%

0.01225

Низкий

8.6 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22