Go/github.com/hashicorp/go-slug CVE-2020-29529: high 7.5, EPSS 2.82%

Unsafe tar unpacking in HashiCorp go-slug

Action: Upgrade github.com/hashicorp/go-slug to 0.5.0 or later.

go get github.com/hashicorp/go-slug@v0.5.0

Affected

Fixed versions

Sources

• osv: GHSA-2g5j-5x95-r6hr
• https://nvd.nist.gov/vuln/detail/CVE-2020-29529
• https://github.com/hashicorp/go-slug/pull/12
• https://github.com/hashicorp/go-slug/commit/28cafc59c8da6126a3ae94dfa84181df4073454f
• https://github.com/hashicorp/go-slug/commit/764785bc4cbb9e600ad1cf1a6bd21b535c182983
• https://github.com/hashicorp/go-slug
• https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
• https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
• https://pkg.go.dev/vuln/GO-2021-0094
• https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug

CVE-2020-29529 · published 2023-02-06T23:16:16Z · modified 2023-11-08T04:03:31.473521Z · JSON