tocsin

CVE-2020-5415

2 advisories.

Go/github.com/concourse/concourse CVE-2020-5415: high 7.5

GitLab auth uses full name instead of username as user ID, allowing impersonation

Action: Upgrade github.com/concourse/concourse to 0.0.0-20200730151558-b00d1c8d8576 or later.

go get github.com/concourse/concourse@v6.4.1
go get github.com/concourse/concourse@v6.3.1
go get github.com/concourse/concourse@v0.0.0-20200730151558-b00d1c8d8576
go get github.com/concourse/concourse@v1.6.1-0.20200730151558-b00d1c8d8576

Affected

introducedfixedlast affected
6.4.06.4.1-
1.6.16.3.1-
0--
0.0.01.6.1-0.20200730151558-b00d1c8d8576-

Fixed versions

6.4.16.3.10.0.0-20200730151558-b00d1c8d85761.6.1-0.20200730151558-b00d1c8d8576

Sources

CVE-2020-5415 · published · modified · JSON

Go/github.com/concourse/dex CVE-2020-5415: high 7.5

GitLab auth uses full name instead of username as user ID, allowing impersonation

Action: Upgrade github.com/concourse/dex to 0.0.0-20200730150203-821b48abfd88 or later.

go get github.com/concourse/dex@v6.4.1
go get github.com/concourse/dex@v6.3.1
go get github.com/concourse/dex@v0.0.0-20200730150203-821b48abfd88

Affected

introducedfixedlast affected
6.4.06.4.1-
0.0.06.3.1-
0--

Fixed versions

6.4.16.3.10.0.0-20200730150203-821b48abfd88

Sources

CVE-2020-5415 · published · modified · JSON