CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2022-36129
https://notcve.org/view.php?id=CVE-2022-36129
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1. Los clústeres de HashiCorp Vault Enterprise 1.7.0 a 1.9.7, 1.10.4 y 1.11.0 que utilizan Integrated Storage exponen un punto final de API no autenticado que podría ser abusado para anular el estado de votante de un nodo dentro de un clúster de Vault HA, introduciendo la posibilidad de una futura pérdida de datos o un fallo catastrófico. Corregido en Vault Enterprise 1.9.8, 1.10.5 y 1.11.1 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420 https://security.netapp.com/advisory/ntap-20220901-0011 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-30324
https://notcve.org/view.php?id=CVE-2022-30324
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1. HashiCorp Nomad y Nomad Enterprise versiones 0.2.0 hasta 1.3.0, fueron impactados por vulnerabilidades de go-getter que permiten una escalada de privilegios mediante la estrofa de artefactos en los trabajos enviados en el host del agente cliente. Corregido en versiones 1.1.14, 1.2.8 y 1.3.1 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-14-nomad-impacted-by-go-getter-vulnerabilities/39932 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-26945 – go-getter: command injection vulnerability
https://notcve.org/view.php?id=CVE-2022-26945
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0. go-getter hasta 1.5.11 y 2.0.2 permitía el cambio de protocolo, la redirección infinita y la derivación de la configuración mediante el abuso del procesamiento de cabeceras de respuesta HTTP personalizadas. Corregido en 1.6.1 y 2.1.0 A flaw was found in go-getter. This flaw allows an attacker to misuse go-getter to execute commands on the host. This action may be possible when symlink processing and path traversal are allowed. • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 https://access.redhat.com/security/cve/CVE-2022-26945 https://bugzilla.redhat.com/show_bug.cgi?id=2092928 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2022-30321 – go-getter: unsafe download (issue 1 of 3)
https://notcve.org/view.php?id=CVE-2022-30321
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0. go-getter hasta 1.5.11 y 2.0.2 permitía el acceso arbitrario al host a través del recorrido de go-getter, el procesamiento de enlaces simbólicos y los fallos de inyección de comandos. Corregido en 1.6.1 y 2.1.0 A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 https://github.com/hashicorp/go-getter/releases https://access.redhat.com/security/cve/CVE-2022-30321 https://bugzilla.redhat.com/show_bug.cgi?id=2092918 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-229: Improper Handling of Values •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2022-30322 – go-getter: unsafe download (issue 2 of 3)
https://notcve.org/view.php?id=CVE-2022-30322
go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0. go-getter hasta 1.5.11 y 2.0.2 permitía el agotamiento asimétrico de recursos cuando go-getter procesaba respuestas HTTP maliciosas. Corregido en 1.6.1 y 2.1.0 A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 https://github.com/hashicorp/go-getter/releases https://access.redhat.com/security/cve/CVE-2022-30322 https://bugzilla.redhat.com/show_bug.cgi?id=2092923 • CWE-229: Improper Handling of Values •