CVE-2023-0475 HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs

Description

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Affected products and versions

Product	Affected versions	Fixed in
go-getter 2.1	earliest → 2.1.1	No fix stated
go-getter 1.6	earliest → 1.6.2	No fix stated

Other CVEs of go-getter

The 2 CVEs of go-getter →

CVE-2024-3817 HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches 9.8 Critical