PT-2025-3860 · Hashicorp+1 · Go-Slug+1
Published
2025-01-21
·
Updated
2025-12-30
·
CVE-2025-0377
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
HashiCorp go-slug versions prior to 0.16.3
Description
The go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This occurs because the unpacking step improperly validates paths, potentially leading to path traversal, allowing an attacker to write an arbitrary file during extraction. The library offers functions for packing and unpacking Terraform Enterprise compatible slugs, which are gzip compressed tar files containing Terraform configuration files.
Recommendations
For versions prior to 0.16.3, upgrade go-slug to 0.16.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of user-provided paths in the tar entry to minimize the risk of exploitation. Consumers of the go-slug shared library should evaluate the risk associated with this issue in the context of their go-slug usage.
Fix
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Go-Slug