GitHub Advisoryadvisory · Go
GHSA-ggp5-28x4-xcj9 Minder GetRepositoryByName data leak
MEDIUM
Official page ↗
- Aliases
- CVE-2024-31455
- Ecosystem
- Go
- Packages
- github.com/stacklok/minder
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2024-04-09
Affected packages
• Go github.com/stacklok/minder: >= 0.0.39, < 0.0.40 → fixed in 0.0.40
Description
Impact
A recent refactoring added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository.
Patches
Patched in #2941
Workarounds
Revert prior to `5c381cf`, or roll forward past `2eb94e7`
References
N/A
Related
Alias · CVE (1)
- CVE-2024-31455 Minder by Stacklok is an open source software supply chain security platform. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/stacklok/minder/security/advisories/GHSA-ggp5-28x4-xcj9 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-31455 advisory
- https://github.com/stacklok/minder/pull/2941 web
- https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4 web
- https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b web
- https://github.com/stacklok/minder package