CVE-2022-29810: Sensitive Information Insertion into Log File in Hashicorp go-getter

Background

Hashicorp go-getter is a Go library that facilitates the retrieval of remote resources. It is commonly used for fetching dependencies and managing package versions in Go projects. The library provides a simple and efficient way to download files from various sources, including Git, Mercurial, and S3. However, versions prior to 1.5.11 suffer from a vulnerability that allows the insertion of sensitive information into the log file. This vulnerability can potentially expose SSH credentials to local users who have access to the log file.

Vulnerability Detail

The vulnerability in Hashicorp go-getter arises from the improper handling of SSH credentials. When performing certain operations, the library writes SSH credentials to its log file without proper protection. This means that any local user with read access to the log file can potentially obtain sensitive SSH credentials. The impact of this vulnerability depends on the context in which the library is used. If the log file is accessible to untrusted users, it can lead to unauthorized access to remote systems or compromise of sensitive data. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.

go get github.com/hashicorp/go-getter@v1.5.11

Workaround

As a temporary workaround, developers can manually modify the code to prevent the logging of SSH credentials. This can be achieved by modifying the logging configuration or implementing custom logging logic that excludes sensitive information. Here is an example of how to disable logging of SSH credentials in a Go application using the go-getter library:

import (
	"github.com/hashicorp/go-getter"
	"log"
)

func main() {
	// Disable logging of SSH credentials
	getter.Logger = log.New(ioutil.Discard, "", 0)

	// Rest of the application code
}

Conclusion

In conclusion, the Hashicorp go-getter library prior to version 1.5.11 is vulnerable to the insertion of sensitive information into the log file. This can expose SSH credentials to local users with access to the log file. To mitigate this vulnerability, it is recommended to upgrade to version 1.5.11 or later of the library. Developers can also implement a temporary workaround by disabling logging of SSH credentials. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/hashicorp/go-getter →

FAQ