GitHub Advisoryadvisory · Go

GHSA-p6fh-xc6r-g5hw Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication

HIGH Published 2022-09-27 Modified 2022-09-27 Official page ↗
Aliases
CVE-2022-39219
Ecosystem
Go
Packages
github.com/brokercap/Bifrost
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Weaknesses
CWE-287, CWE-732
Reviewed
2022-09-27

Affected packages

• Go github.com/brokercap/Bifrost: < 1.8.7-release → fixed in 1.8.7-release

Description

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.

Related

Alias · CVE (1)

  • CVE-2022-39219 Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References