Go/github.com/bradleyfalzon/ghinstallation CVE-2022-39304: unknown, EPSS 0.39%
JWT leak in github.com/bradleyfalzon/ghinstallation
Action: Upgrade github.com/bradleyfalzon/ghinstallation to 1.1.2-0.20210308182858-d24f14f8be70 or later.
go get github.com/bradleyfalzon/ghinstallation@v1.1.2-0.20210308182858-d24f14f8be70Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.2-0.20210308182858-d24f14f8be70 | - |
Fixed versions
| 1.1.2-0.20210308182858-d24f14f8be70 |
Sources
- osv: GO-2022-1178
- https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgr
- https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3e
- https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation
CVE-2022-39304 · published · modified · JSON