modules:
  - module: github.com/hashicorp/go-getter
    versions:
      - introduced: 1.5.11
        fixed: 1.6.1
    packages:
      - package: github.com/hashicorp/go-getter
  - module: github.com/hashicorp/go-getter/v2
    versions:
      - introduced: 2.0.2
        fixed: 2.1.0
    packages:
      - package: github.com/hashicorp/go-getter/v2
description: |
    Malicious HTTP responses can cause a number of misbehaviors,
    including overwriting local files, resource exhaustion, and panics.

    * Protocol switching, endless redirect, and configuration bypass are
      possible through abuse of custom HTTP response header processing.

    * Arbitrary host access is possible through go-getter path traversal,
      symlink processing, and command injection flaws.

    * Asymmetric resource exhaustion can occur when go-getter processes
      malicious HTTP responses.

    * A panic can be triggered when go-getter processed password-protected ZIP
      files.
published: 2022-05-26T00:01:27Z
cves:
  - CVE-2022-26945
  - CVE-2022-30321
  - CVE-2022-30322
  - CVE-2022-30323
ghsas:
  - GHSA-28r2-q6m8-9hpx
  - GHSA-cjr4-fv6c-f3mv
  - GHSA-fcgg-rvwg-jv58
  - GHSA-x24g-9w7v-vprh
credit: Joern Schneeweisz of GitLab, Alessio Della Libera of Snyk, and HashiCorp Product
    Security
references:
  - advisory: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
  - fix: https://github.com/hashicorp/go-getter/pull/361
  - fix: https://github.com/hashicorp/go-getter/commit/38e97387488f5439616be60874979433a12edb48
  - web: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
  - web: https://github.com/hashicorp/go-getter/pull/359