Go/github.com/dapr/dapr CVE-2023-37918: medium 6.8, EPSS 1.40%
Dapr API token authentication bypass in HTTP endpoints
Action: Upgrade github.com/dapr/dapr to 1.10.9 or later.
go get github.com/dapr/dapr@v1.11.2go get github.com/dapr/dapr@v1.10.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.11.0 | 1.11.2 | - |
| 0 | 1.10.9 | - |
Fixed versions
| 1.11.2 | 1.10.9 |
Sources
- osv: GHSA-59m6-82qm-vqgj
- https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj
- https://nvd.nist.gov/vuln/detail/CVE-2023-37918
- https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a
- https://github.com/dapr/dapr/commit/99d6799c97b79397443c8c96737c9b893126a1ae
- https://docs.dapr.io/operations/security/api-token
- https://github.com/dapr/dapr
CVE-2023-37918 · published · modified · JSON