Resource Exhaustion Vulnerability in go-getter by HashiCorp
CVE-2022-30322

8.6HIGH

Key Information:

Vendor
Hashicorp
Status
Go-getter
Vendor
CVE Published:
25 May 2022

Summary

The go-getter library prior to version 1.6.1 and 2.1.0 is susceptible to a vulnerability where it can become overwhelmed by asymmetric resource exhaustion due to the processing of malicious HTTP responses. This flaw can potentially disrupt the normal operation of applications utilizing the go-getter library, leading to performance degradation or system instability. Users are advised to update to the latest versions to mitigate this risk.

References

https://discuss.hashicorp.com
x_refsource_MISC
https://github.com/hashicorp/go-getter/releases
x_refsource_MISC
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vu...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.