[Git][security-tracker-team/security-tracker][master] Update status for golang-github-hashicorp-go-getter which got reintroduced into Debian unstable

Tue Nov 3 06:21:19 GMT 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2441d447 by Salvatore Bonaccorso at 2026-11-03T07:20:32+01:00
Update status for golang-github-hashicorp-go-getter which got reintroduced into Debian unstable

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -37347,7 +37347,7 @@ CVE-2026-27420 (Improper Neutralization of Input During Web Page Generation ('Cr
 CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
 	NOT-FOR-US: IBM
 CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions b ...)
-	- golang-github-hashicorp-go-getter <removed>
+	- golang-github-hashicorp-go-getter <unfixed>
 	[bookworm] - golang-github-hashicorp-go-getter <no-dsa> (Limited support)
 CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
 	NOT-FOR-US: IBM
@@ -66544,7 +66544,7 @@ CVE-2026-88976 (Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3
 CVE-2026-88975 (Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1. ...)
 	NOT-FOR-US: Http4s
 CVE-2026-88922 (The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to  ...)
-	- golang-github-hashicorp-go-getter <removed>
+	- golang-github-hashicorp-go-getter <unfixed>
 	[bookworm] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue)
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752
 CVE-2026-88910 (The kboard WordPress plugin before 6.7 does not verify ownership or co ...)
@@ -211820,7 +211820,7 @@ CVE-2026-5329 (Rapid7 Velociraptor versions prior to 0.76.2contain an improper i
 CVE-2026-4901 (AlanWeb SCADA saves sensitive information into a log file. Critically, ...)
 	NOT-FOR-US: Hydrosystem Control System
 CVE-2026-4660 (HashiCorp\u2019s go-getter library up to v1.8.5 may allow arbitrary fi ...)
-	- golang-github-hashicorp-go-getter <removed>
+	- golang-github-hashicorp-go-getter <unfixed>
 	[bookworm] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
 	[bullseye] - golang-github-hashicorp-go-getter <postponed> (Minor issue)
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311
@@ -309482,7 +309482,7 @@ CVE-2025-38502 (In the Linux kernel, the following vulnerability has been resolv
 	- linux 6.16.3-1
 	NOTE: https://git.kernel.org/linus/abad3d0bad72a52137e0c350c59542d75ae4f513 (6.17-rc1)
 CVE-2025-8959 (HashiCorp's go-getter library subdirectory download feature is vulnera ...)
-	- golang-github-hashicorp-go-getter <removed> (bug #1111318)
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1111318)
 	[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
 	[bullseye] - golang-github-hashicorp-go-getter <postponed> (Minor issue)
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242
@@ -432632,7 +432632,7 @@ CVE-2024-6300 (Incomplete cleanup when performing redactions in Conduit, allowin
 CVE-2024-6299 (Lack of consideration of key expiry when validating signatures in Cond ...)
 	NOT-FOR-US: Conduit
 CVE-2024-6257 (HashiCorp\u2019s go-getter library can be coerced into executing Git u ...)
-	- golang-github-hashicorp-go-getter <removed> (bug #1075823)
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1075823)
 	[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
 	[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081
@@ -456375,7 +456375,7 @@ CVE-2024-3900 (Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by
 CVE-2024-3825 (Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw ...)
 	NOT-FOR-US: Jenkins plugin
 CVE-2024-3817 (HashiCorp\u2019s go-getter library is vulnerable to argument injection ...)
-	- golang-github-hashicorp-go-getter <removed> (bug #1083184)
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1083184)
 	[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
 	[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
 	[buster] - golang-github-hashicorp-go-getter <not-affected> (Vulnerable code not present)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2441d44723d80e4676915e7ccd55cb6f5e82f223

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2441d44723d80e4676915e7ccd55cb6f5e82f223
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/512e4e70/attachment.htm>
