[Git][security-tracker-team/security-tracker][master] Update status for golang-github-hashicorp-go-getter issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Nov 3 06:41:27 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d44cddae by Salvatore Bonaccorso at 2026-11-03T07:40:28+01:00
Update status for golang-github-hashicorp-go-getter issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -37347,7 +37347,7 @@ CVE-2026-27420 (Improper Neutralization of Input During Web Page Generation ('Cr
CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
NOT-FOR-US: IBM
CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions b ...)
- - golang-github-hashicorp-go-getter <unfixed>
+ - golang-github-hashicorp-go-getter 1.8.9-1
[bookworm] - golang-github-hashicorp-go-getter <no-dsa> (Limited support)
CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
NOT-FOR-US: IBM
@@ -66544,7 +66544,7 @@ CVE-2026-88976 (Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3
CVE-2026-88975 (Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1. ...)
NOT-FOR-US: Http4s
CVE-2026-88922 (The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to ...)
- - golang-github-hashicorp-go-getter <unfixed>
+ - golang-github-hashicorp-go-getter 1.8.9-1
[bookworm] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue)
NOTE: https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752
CVE-2026-88910 (The kboard WordPress plugin before 6.7 does not verify ownership or co ...)
@@ -211820,7 +211820,7 @@ CVE-2026-5329 (Rapid7 Velociraptor versions prior to 0.76.2contain an improper i
CVE-2026-4901 (AlanWeb SCADA saves sensitive information into a log file. Critically, ...)
NOT-FOR-US: Hydrosystem Control System
CVE-2026-4660 (HashiCorp\u2019s go-getter library up to v1.8.5 may allow arbitrary fi ...)
- - golang-github-hashicorp-go-getter <unfixed>
+ - golang-github-hashicorp-go-getter 1.8.9-1
[bookworm] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <postponed> (Minor issue)
NOTE: https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311
@@ -309482,7 +309482,7 @@ CVE-2025-38502 (In the Linux kernel, the following vulnerability has been resolv
- linux 6.16.3-1
NOTE: https://git.kernel.org/linus/abad3d0bad72a52137e0c350c59542d75ae4f513 (6.17-rc1)
CVE-2025-8959 (HashiCorp's go-getter library subdirectory download feature is vulnera ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1111318)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1111318)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <postponed> (Minor issue)
NOTE: https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242
@@ -432632,7 +432632,7 @@ CVE-2024-6300 (Incomplete cleanup when performing redactions in Conduit, allowin
CVE-2024-6299 (Lack of consideration of key expiry when validating signatures in Cond ...)
NOT-FOR-US: Conduit
CVE-2024-6257 (HashiCorp\u2019s go-getter library can be coerced into executing Git u ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1075823)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1075823)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
NOTE: https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081
@@ -456375,7 +456375,7 @@ CVE-2024-3900 (Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by
CVE-2024-3825 (Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw ...)
NOT-FOR-US: Jenkins plugin
CVE-2024-3817 (HashiCorp\u2019s go-getter library is vulnerable to argument injection ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1083184)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1083184)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[buster] - golang-github-hashicorp-go-getter <not-affected> (Vulnerable code not present)
@@ -541679,7 +541679,7 @@ CVE-2023-0477 (The Auto Featured Image (Auto Post Thumbnail) WordPress plugin be
CVE-2023-0476 (A LDAP injection vulnerability exists in Tenable.sc due to improper va ...)
NOT-FOR-US: Tenable
CVE-2023-0475 (HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompressi ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1032100)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1032100)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[buster] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
@@ -603731,7 +603731,7 @@ CVE-2022-30325 (An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devi
CVE-2022-30324 (HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were im ...)
- nomad <not-affected> (In Debian Nomad doesn't bundle go-getter, but build depends a shared deb)
CVE-2022-30323 (go-getter up to 1.5.11 and 2.0.2 panicked when processing password-pro ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1011741)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[buster] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
@@ -603739,7 +603739,7 @@ CVE-2022-30323 (go-getter up to 1.5.11 and 2.0.2 panicked when processing passwo
NOTE: https://github.com/hashicorp/go-getter/pull/359
NOTE: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45 (v1.6.0)
CVE-2022-30322 (go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustio ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1011741)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[buster] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
@@ -603747,7 +603747,7 @@ CVE-2022-30322 (go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exh
NOTE: https://github.com/hashicorp/go-getter/pull/359
NOTE: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45 (v1.6.0)
CVE-2022-30321 (go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go- ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1011741)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[buster] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
@@ -613946,7 +613946,7 @@ CVE-2022-0936 (Cross-site Scripting (XSS) - Stored in GitHub repository autolab/
CVE-2022-26946
RESERVED
CVE-2022-26945 (go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless r ...)
- - golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+ - golang-github-hashicorp-go-getter 1.8.9-1 (bug #1011741)
[bookworm] - golang-github-hashicorp-go-getter <ignored> (Minor issue)
[bullseye] - golang-github-hashicorp-go-getter <no-dsa> (Minor issue)
[buster] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d44cddae8afa23cf4e46212775815c39963bc85b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d44cddae8afa23cf4e46212775815c39963bc85b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/b5d0cd6d/attachment.htm>
More information about the debian-security-tracker-commits
mailing list