Home > Vulnerability Database > CVE-2023-0475

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2023-0475

Good to know:

Date: February 16, 2023

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Language: Go

Severity Score

4.2

Related Resources (7)

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-0475

Url: https://github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc

Url: https://security-tracker.debian.org/tracker/CVE-2023-0475

Url: https://github.com/hashicorp/go-getter/commit/0edab85348271c843782993345b07b1ac98912e6

Url: https://github.com/hashicorp/go-getter

Url: https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125

Url: https://www.mend.io/vulnerability-database/CVE-2023-0475

Severity Score

4.2

Weakness Type (CWE)

Improper Handling of Highly Compressed Data (Data Amplification)

CWE-409

Top Fix

Upgrade Version

Upgrade to version github.com/hashicorp/go-getter - v1.7.0;github.com/hashicorp/go-getter/v2 - v2.2.0

CVSS v3.1

Base Score:	4.2
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

Do you need more information?

Contact Us