Most recent entries from all

EUVD-2026-223221

fkie_cve-2023-0475

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

GHSA-jpxj-2jvg-6jv9 — Data Amplification in HashiCorp go-getter

Affected: Go: github.com/hashicorp/go-getter, Go: github.com/hashicorp/go-getter/v2

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

gsd-2023-0475

msrc_CVE-2023-0475 — Go-Getter Vulnerable to Decompression Bombs

msrc_CVE-2023-0475

RHSA-2023:5006 — Red Hat Security Advisory: OpenShift Container Platform 4.14.0 bug fix and security update

dns: Denial of Service (DoS) osin: manipulation of the argument secret leads to observable timing discrepancy mongo-go-driver: specific cstrings input may not be properly validated cortex: Grafana Cortex directory traversal go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents helm: Denial of service through through repository index file helm: Denial of service through schema file golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding go-getter: go-getter vulnerable to denial of service via malicious compressed archive vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata openshift: OCP & FIPS mode golang.org/x/net/html: Cross site scripting OpenShift: modification of node role labels hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations helm: getHostByName Function Information Disclosure containerd: Supplementary groups are not set up properly word-wrap: ReDoS tough-cookie: prototype pollution in cookie memstore runc: volume mount race condition (regression of CVE-2019-19921) golang-github-gin-gonic-gin: Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)…

UBUNTU-CVE-2023-0475

Affected: Ubuntu:18.04:LTS: golang-github-hashicorp-go-getter, Ubuntu:20.04:LTS: golang-github-hashicorp-go-getter, Ubuntu:20.04:LTS: golang-github-jesseduffield-go-getter, Ubuntu:22.04:LTS: golang-github-hashicorp-go-getter, Ubuntu:22.04:LTS: golang-github-jesseduffield-go-getter, Ubuntu:24.04:LTS: golang-github-hashicorp-go-getter, Ubuntu:24.04:LTS: golang-github-jesseduffield-go-getter, Ubuntu:25.10: golang-github-hashicorp-go-getter

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

WID-SEC-W-2023-1194 — Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Programmcode auszuführen oder Informationen offenzulegen.