CVE-2022-29810 Insertion of Sensitive Information into Log File in Hashicorp go-getter

What is CVE-2022-29810?

CVE-2022-29810 is a medium-severity vulnerability in n/a, published on 27 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

Weakness: CWE-532

Which versions are affected by CVE-2022-29810?

3 open source packages ship an affected version, including github.com/hashicorp/go-getter. It affects 1 product.

Products include Hashicorp Go-Getter.

How do I fix CVE-2022-29810?

Upgrade github.com/hashicorp/go-getter to 1.5.11 or later.

Is CVE-2022-29810 being exploited?

There is no known exploitation of CVE-2022-29810 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches Critical 9.8
• CVE-2022-26945 Server-side request forgery in n/a Critical 9.8
• CVE-2022-30321 Path traversal in n/a High 8.6
• CVE-2022-30322 Denial of service in n/a High 8.6
• CVE-2022-30323 Denial of service in n/a High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-27rq-4943-qcwp, GO-2022-0438.