GitHub Advisoryadvisory · Go

GHSA-hh33-46q4-hwm2 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

MEDIUM Published 2024-11-26 Modified 2024-11-26 Official page ↗
Aliases
CVE-2024-43784
Ecosystem
Go
Packages
github.com/treeverse/lakefs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
Weaknesses
CWE-281, CWE-287
Reviewed
2024-11-26

Affected packages

• Go github.com/treeverse/lakefs: < 1.33.0 → fixed in 1.33.0

Description

Impact Existing lakeFS users who have issued credentials to users who have been deleted. Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion. Patches _Has the problem been patched? What versions should users upgrade to?_ Workarounds A possible workaround will be not to reuse usernames that were previously deleted References _Are there any links users can visit to find out more?_

Related

Alias · CVE (1)

  • CVE-2024-43784 lakeFS is an open-source tool that transforms object storage into a Git-like repository. vulnerability

Weakness · CWE (2)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-287 Improper Authentication weakness

References