CVE-2022-30321

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-30321

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-30321.json

Aliases

• CVE-2022-26945
• CVE-2022-30322
• CVE-2022-30323
• GHSA-28r2-q6m8-9hpx
• GHSA-cjr4-fv6c-f3mv
• GHSA-fcgg-rvwg-jv58
• GHSA-x24g-9w7v-vprh
• GO-2022-0586

Published

2022-05-25T12:15:08Z

Modified

2024-03-15T00:05:25.226817Z

Details

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

References

• https://discuss.hashicorp.com
• https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
• https://github.com/hashicorp/go-getter/releases