Github.Com Hashicorp Go-Getter Gcs V2 vulnerabilities

CVE-2022-26945 [CRITICAL] CWE-77 HashiCorp go-getter command injection HashiCorp go-getter command injection HashiCorp go-getter before 2.0.2 allows Command Injection.

CVE-2022-30323 [HIGH] HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious HTTP responses.

CVE-2022-30322 [HIGH] HashiCorp go-getter unsafe downloads could lead to arbitrary host access HashiCorp go-getter unsafe downloads could lead to arbitrary host access HashiCorp go-getter through 2.0.2 does not safely perform downloads. Arbitrary host access was possible via go-getter path traversal, symlink processing, and command injection flaws.

CVE-2022-30321 [HIGH] HashiCorp go-getter unsafe downloads HashiCorp go-getter unsafe downloads HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.