Go/github.com/concourse/dex CVE-2020-5415: high 7.5, EPSS 1.22%
GitLab auth uses full name instead of username as user ID, allowing impersonation
Action: Upgrade github.com/concourse/dex to 0.0.0-20200730150203-821b48abfd88 or later.
go get github.com/concourse/dex@v6.4.1go get github.com/concourse/dex@v6.3.1go get github.com/concourse/dex@v0.0.0-20200730150203-821b48abfd88Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.4.0 | 6.4.1 | - |
| 0.0.0 | 6.3.1 | - |
| 0 | - | - |
Fixed versions
| 6.4.1 | 6.3.1 | 0.0.0-20200730150203-821b48abfd88 |
Sources
- osv: GHSA-627p-rr78-99rj#Go/github.com/concourse/dex
- https://github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj
- https://nvd.nist.gov/vuln/detail/CVE-2020-5415
- https://tanzu.vmware.com/security/cve-2020-5415
CVE-2020-5415 · published · modified · JSON