CVE-2022-29810

MEDIUM

Hashicorp Go-getter < 1.5.11 - Log Information Exposure

Title source: rule
STIX 2.1

Description

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/hashicorp/go-getter/pull/348
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/hashicorp/go-getter/releases/tag/v1.5.11

Scores

CVSS v3 5.5
EPSS 0.0010
EPSS Percentile 27.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-532
Status published
Products (2)
hashicorp/go-getter < 1.5.11
hashicorp/go-getter 0 - 1.5.11Go
Published Apr 27, 2022
Tracked Since Feb 18, 2026