PT-2022-20064 · Hashicorp+1 · Go-Getter+1

Alessio Della Libera + 1 · Published 2022-05-25 · Updated 2022-11-21 · CVE-2022-30322

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp go-getter versions 1.5.11 and earlier, 2.0.2 and earlier

Description The issue allows for asymmetric resource exhaustion when processing malicious HTTP responses. It also enables protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Additionally, arbitrary host access is possible through path traversal, symlink processing, and command injection flaws. Malicious HTTP responses can cause misbehaviors, including overwriting local files, resource exhaustion, and panics. A panic can be triggered when processing password-protected ZIP files.

Recommendations For versions 1.5.11 and earlier, update to version 1.6.1 or later. For version 2.0.2, update to version 2.1.0 or later. As a temporary workaround, consider restricting access to the go-getter function until a patch is available. Avoid using go-getter to process malicious HTTP responses until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-30322

GHSA-28R2-Q6M8-9HPX

GHSA-CJR4-FV6C-F3MV

GHSA-FCGG-RVWG-JV58

GHSA-X24G-9W7V-VPRH

GO-2022-0586

Affected Products

Debian

Go-Getter

References · 26

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30322 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjr4-fv6c-f3mv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26945 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-30321 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-30322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30323 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-30322 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-28r2-q6m8-9hpx · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30322 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fcgg-rvwg-jv58 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x24g-9w7v-vprh · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0586 · Vendor Advisory