Hashicorp

Go-slug

2 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2025-0377

  • EPSS 0.07%
  • Published 21.01.2025 16:15:14
  • Last modified 21.01.2025 16:15:14

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

7.5

CVE-2020-29529

Exploit
  • EPSS 1.33%
  • Published 03.12.2020 20:15:11
  • Last modified 21.11.2024 05:24:09

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.