What’s Vulnerable › Vulnerabilities

CVE-2022-29810

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-27 · updated 2026-06-17
• Weakness: CWE-532

Description

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

Affected products

• HashiCorp go-getter: before 1.5.11 — fixed in 1.5.11

How to fix

Upgrade to a fixed version: HashiCorp go-getter 1.5.11. Check the vendor advisory for mitigations.

References

• https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
• https://github.com/hashicorp/go-getter/pull/348
• https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
• https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
• https://github.com/hashicorp/go-getter/pull/348
• https://github.com/hashicorp/go-getter/releases/tag/v1.5.11

Get alerted when CVE-2022-29810 or the next vulnerability affects your stack