title: Go-Getter Vulnerable to Decompression Bombs
description: HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
problem types: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
affected:
{
vendor: HashiCorp
product: go-getter
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
repo: https://github.com/hashicorp/go-getter
versions:
status: affected, version: 0, lessThanOrEqual: 1.6.2, versionType: semver
status: affected, version: 0, lessThanOrEqual: 2.1.1, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
]