{"id":"CVE-2022-29810","aliases":["EUVD-2022-1591","GHSA-27rq-4943-qcwp","GO-2022-0438"],"status":"published","title":"Insertion of Sensitive Information into Log File in Hashicorp go-getter","description":"The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0041,"percentile":0.35686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2022-04-27T05:50:30Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/go-getter","fixed_in":["1.5.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/go-getter","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/go-getter","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.11"}]}]}],"products":[{"vendor":"hashicorp","product":"go-getter"}],"references":[{"url":"https://github.com/hashicorp/go-getter/pull/348","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/hashicorp/go-getter/releases/tag/v1.5.11","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29810","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0438","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27rq-4943-qcwp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29810.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/go-getter","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-29810","description":"The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.","status":"published","published":"2022-04-27T05:50:30Z","modified":"2024-08-03T06:33:42.774Z","updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-1591","description":"The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.","status":"published","published":"2022-04-27T05:50:30Z","modified":"2024-08-03T06:33:42Z","updated_at":"2026-11-03T03:25:38.110935Z"}],"ghsa":[{"id":"GHSA-27rq-4943-qcwp","title":"Insertion of Sensitive Information into Log File in Hashicorp go-getter","description":"The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.","status":"published","published":"2022-04-28T00:00:35Z","modified":"2023-02-09T20:12:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2022-29810","description":"The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.","status":"published","published":"2022-04-27T06:15:40.247Z","modified":"2026-06-17T04:40:45.067Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"GHSA-27rq-4943-qcwp","title":"Insertion of Sensitive Information into Log File in Hashicorp go-getter","description":"The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.","status":"published","published":"2022-04-28T00:00:35Z","modified":"2023-11-08T04:09:14.685218Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"CVE-2022-29810","description":"The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.","status":"published","published":"2022-04-27T05:50:30Z","modified":"2026-10-28T02:30:45.157166758Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GO-2022-0438","title":"Exposure of sensitive information via log file in github.com/hashicorp/go-getter","description":"The getter package can write SSH credentials to its logfile, exposing credentials to local users able to read the logfile.","status":"published","published":"2022-07-01T20:07:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}