Go/github.com/treeverse/lakefs: medium 5.3
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository
Action: Upgrade github.com/treeverse/lakefs to 1.12.1 or later.
go get github.com/treeverse/lakefs@v1.12.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.90.0 | 1.12.1 | - |
Fixed versions
| 1.12.1 |
Sources
- osv: GHSA-fvv5-h29g-f6w5
- https://github.com/treeverse/lakeFS/security/advisories/GHSA-fvv5-h29g-f6w5
- https://github.com/treeverse/lakeFS/commit/56556ee5406fc5425b9302cd08a8d412635fdcd7
- https://github.com/treeverse/lakeFS
published · modified · JSON