modules:
  - module: github.com/hashicorp/go-getter/v2
    versions:
      - introduced: 2.0.0
        fixed: 2.2.0
    vulnerable_at: 2.0.0
    packages:
      - package: github.com/hashicorp/go-getter/v2
        symbols:
          - untar
          - ZipDecompressor.Decompress
          - copyReader
        derived_symbols:
          - Bzip2Decompressor.Decompress
          - Client.Get
          - Client.GetChecksum
          - FolderStorage.Get
          - Get
          - GetAny
          - GetFile
          - GzipDecompressor.Decompress
          - HttpGetter.Get
          - Request.CopyReader
          - TarBzip2Decompressor.Decompress
          - TarGzipDecompressor.Decompress
          - TarXzDecompressor.Decompress
          - XzDecompressor.Decompress
        skip_fix: TODO include package variable Decompressors.
  - module: github.com/hashicorp/go-getter
    versions:
      - fixed: 1.7.0
    vulnerable_at: 1.6.0
    packages:
      - package: github.com/hashicorp/go-getter
        symbols:
          - untar
          - ZipDecompressor.Decompress
          - copyReader
        derived_symbols:
          - Bzip2Decompressor.Decompress
          - Client.ChecksumFromFile
          - Client.Get
          - FolderStorage.Get
          - GCSGetter.Get
          - GCSGetter.GetFile
          - Get
          - GetAny
          - GetFile
          - GzipDecompressor.Decompress
          - HttpGetter.Get
          - S3Getter.Get
          - S3Getter.GetFile
          - TarBzip2Decompressor.Decompress
          - TarDecompressor.Decompress
          - TarGzipDecompressor.Decompress
          - TarXzDecompressor.Decompress
          - TarZstdDecompressor.Decompress
          - XzDecompressor.Decompress
          - ZstdDecompressor.Decompress
        skip_fix: TODO include package variable Decompressors.
description: |-
    HashiCorp go-getter is vulnerable to decompression bombs. This can lead
    to excessive memory consumption and denial-of-service attacks.
cves:
  - CVE-2023-0475
ghsas:
  - GHSA-jpxj-2jvg-6jv9
references:
  - web: https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
  - fix: https://github.com/hashicorp/go-getter/commit/0edab85348271c843782993345b07b1ac98912e6
  - fix: https://github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc