| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/go-getter | ≥ 2.0.0, < 2.1.0< 1.6.1 | 2.1.01.6.1 |
| github.com/hashicorp/go-getter/gcs/v2 | < 2.1.0 | 2.1.0 |
| github.com/hashicorp/go-getter/s3/v2 | < 2.1.0 | 2.1.0 |
| github.com/hashicorp/go-getter/v2 | < 2.1.0 | 2.1.0 |
| go-getter | = 2.0.2≤ 1.5.11 |
HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious HTTP responses.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free