Github.Com Hashicorp Go-Getter V2 vulnerabilities

CVE-2023-0475 [MEDIUM] CWE-409 Data Amplification in HashiCorp go-getter Data Amplification in HashiCorp go-getter HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

CVE-2022-26945 [CRITICAL] CWE-77 HashiCorp go-getter command injection HashiCorp go-getter command injection HashiCorp go-getter before 2.0.2 allows Command Injection.

CVE-2022-30323 [HIGH] HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious HTTP responses.

CVE-2022-30322 [HIGH] HashiCorp go-getter unsafe downloads could lead to arbitrary host access HashiCorp go-getter unsafe downloads could lead to arbitrary host access HashiCorp go-getter through 2.0.2 does not safely perform downloads. Arbitrary host access was possible via go-getter path traversal, symlink processing, and command injection flaws.

CVE-2022-30321 [HIGH] HashiCorp go-getter unsafe downloads HashiCorp go-getter unsafe downloads HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.