Go/github.com/gitpod-io/gitpod CVE-2024-21583: medium 4.1, EPSS 0.60%
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.8.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-8pgc-65mj-53h5
- https://nvd.nist.gov/vuln/detail/CVE-2024-21583
- https://github.com/gitpod-io/gitpod/pull/19973
- https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155
- https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d
- https://github.com/gitpod-io/gitpod
- https://pkg.go.dev/vuln/GO-2024-2997
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078
- https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079
CVE-2024-21583 · published · modified · JSON