CVE-2023-0475

low-risk
Published 2023-02-16

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.2/10 Medium
LOCAL / LOW complexity

Affected Products (2)

Go-Getter
Go-Getter

Affected Vendors

Hashicorp

References (2)

Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-s...
Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-s...
22
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 7/34 · Low