What is GHSA-jpxj-2jvg-6jv9?

GHSA-jpxj-2jvg-6jv9 is a security advisory published by GitHub Security Advisories with Medium severity. Data Amplification in HashiCorp go-getter

Which CVE IDs does GHSA-jpxj-2jvg-6jv9 cover?

GHSA-jpxj-2jvg-6jv9 covers the following CVE IDs: CVE-2023-0475. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jpxj-2jvg-6jv9?

GHSA-jpxj-2jvg-6jv9 has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-jpxj-2jvg-6jv9?

GHSA-jpxj-2jvg-6jv9 affects 2 products, including: go/github.com/hashicorp/go-getter:\u003c 1.7.0; go/github.com/hashicorp/go-getter/v2:\u003e= 2.0.0, \u003c 2.2.0.

GHSA-jpxj-2jvg-6jv9MediumCVSS 4.2

Data Amplification in HashiCorp go-getter

Vendor

GitHub Security Advisories

Published

February 16, 2023

Last Modified

May 20, 2024

🔗 CVE IDs covered (1)

CVE-2023-0475 →

📋 Description

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

🎯 Affected products2

go/github.com/hashicorp/go-getter:< 1.7.0
go/github.com/hashicorp/go-getter/v2:>= 2.0.0, < 2.2.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-0475
https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
https://github.com/hashicorp/go-getter/commit/0edab85348271c843782993345b07b1ac98912e6
https://github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc
https://github.com/advisories/GHSA-jpxj-2jvg-6jv9