GitHub Advisoryadvisory · Go

GHSA-28q9-9c3g-v3f9 lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

HIGH Published 2022-09-23 Modified 2022-09-23 Official page ↗
Ecosystem
Go
Packages
github.com/treeverse/lakefs
Severity
High
Weaknesses
CWE-281, CWE-284
Reviewed
2022-09-23

Affected packages

• Go github.com/treeverse/lakefs: < 0.82.0 → fixed in 0.82.0

Description

Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. Patches lakeFS v0.82.0 and later Workarounds Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS". References advisories/GHSA-28q9-9c3g-v3f9 For more information If you have any questions or comments about this advisory: Ask on the lakeFS Slack #help channel Email us at [email protected]

Related

Weakness · CWE (2)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-284 Improper Access Control weakness

References