PT-2022-20063 · Hashicorp+1 · Go-Getter+1

Alessio Della Libera + 1 · Published 2022-05-25 · Updated 2023-08-08 · CVE-2022-30321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp go-getter versions 1.5.11 and earlier, 2.0.2 and earlier HashiCorp go-getter versions up to 2.0.2

Description The issue allows for arbitrary host access via path traversal, symlink processing, and command injection flaws. It also enables protocol switching, endless redirect, and configuration bypass through abuse of custom HTTP response header processing. Additionally, asymmetric resource exhaustion can occur when processing malicious HTTP responses. Malicious HTTP responses can cause misbehaviors, including overwriting local files, resource exhaustion, and panics.

Recommendations For HashiCorp go-getter versions 1.5.11 and earlier, update to version 1.6.1 or later. For HashiCorp go-getter versions 2.0.2 and earlier, update to version 2.1.0 or later. As a temporary workaround, consider restricting the use of go-getter until a patch is applied. Avoid using go-getter to process malicious or untrusted HTTP responses.

Fix

Path traversal

Link Following

Command Injection

Weakness Enumeration

CWE-22

CWE-59

CWE-77

Related Identifiers

CVE-2022-30321

GHSA-28R2-Q6M8-9HPX

GHSA-CJR4-FV6C-F3MV

GHSA-FCGG-RVWG-JV58

GHSA-X24G-9W7V-VPRH

GO-2022-0586

Affected Products

Debian

Go-Getter

References · 26

• https://osv.dev/vulnerability/GHSA-fcgg-rvwg-jv58 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjr4-fv6c-f3mv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26945 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-30321 · Security Note
• https://osv.dev/vulnerability/GHSA-x24g-9w7v-vprh · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-30321 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-30321 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30321 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30321 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30323 · Security Note
• https://osv.dev/vulnerability/GHSA-28r2-q6m8-9hpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30322 · Security Note