GitHub Advisoryadvisory · Go

GHSA-75r6-6jg8-pfcq octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and memory usage

LOW Published 2024-05-13 Modified 2024-07-05 Official page ↗
Aliases
CVE-2024-34079
Ecosystem
Go
Packages
github.com/octo-sts/app
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2024-05-13

Affected packages

• Go github.com/octo-sts/app: < 0.1.0 → fixed in 0.1.0

Description

Impact This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. Patches This vulnerability existed in the repository at HEAD, we will cut a 0.1.0 release with the fix. Workarounds None References None

Related

Alias · CVE (1)

  • CVE-2024-34079 octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References