CVE-2023-0475 Go-Getter Vulnerable to Decompression Bombs

What is CVE-2023-0475?

CVE-2023-0475 is a medium-severity denial of service vulnerability in HashiCorp go-getter, published on 16 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Weakness: CWE-409

Which versions are affected by CVE-2023-0475?

6 open source packages ship an affected version, including github.com/hashicorp/go-getter and github.com/hashicorp/go-getter/v2. It affects 1 product.

Products include Hashicorp Go-Getter.

How do I fix CVE-2023-0475?

Upgrade github.com/hashicorp/go-getter to 1.7.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-0475 being exploited?

There is no known exploitation of CVE-2023-0475 in the wild and no public exploit code.

Other vulnerabilities in HashiCorp go-getter

• CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches Critical 9.8
• CVE-2022-26945 Server-side request forgery in n/a Critical 9.8
• CVE-2022-30321 Path traversal in n/a High 8.6
• CVE-2022-30322 Denial of service in n/a High 8.6
• CVE-2022-30323 Denial of service in n/a High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-13586, AZL-13606, DEBIAN-CVE-2023-0475, GHSA-jpxj-2jvg-6jv9, GO-2023-1578, UBUNTU-CVE-2023-0475.