CVE-2024-3817
Critical
Description
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.
SeverityCritical
CVSS9.8
Exploit probability—
ProductHashicorp Go-getter
PublishedApr 17, 2024
First seenApr 17, 2024
Weakness typeCWE-88CWE-88
How to fix
Update
- hashicorp go-getter1.7.4 or later
- github.com/hashicorp/go-getter1.7.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hashicorp go-getter | 1.5.9 ≤ v < 1.7.4 | 1.7.4 |
| github.com/hashicorp/go-getterGo | 1.5.9 ≤ v < 1.7.4 | 1.7.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.