CVE-2022-39304
2 advisories.
Go/github.com/bradleyfalzon/ghinstallation CVE-2022-39304: medium 5
ghinstallation returns app JWT in error responses
Action: Upgrade github.com/bradleyfalzon/ghinstallation to 2.0.0 or later.
go get github.com/bradleyfalzon/ghinstallation@v2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: GHSA-h4q8-96p6-jcgr
- https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgr
- https://nvd.nist.gov/vuln/detail/CVE-2022-39304
- https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3e
- https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation
- https://github.com/bradleyfalzon/ghinstallation
- https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff731d7e2ef72a5c/transport.go#L172-L174
- https://pkg.go.dev/vuln/GO-2022-1178
- https://securitylab.github.com/advisories/GHSL-2022-061_ghinstallation
CVE-2022-39304 · published · modified · JSON
Go/github.com/bradleyfalzon/ghinstallation CVE-2022-39304: unknown
JWT leak in github.com/bradleyfalzon/ghinstallation
Action: Upgrade github.com/bradleyfalzon/ghinstallation to 1.1.2-0.20210308182858-d24f14f8be70 or later.
go get github.com/bradleyfalzon/ghinstallation@v1.1.2-0.20210308182858-d24f14f8be70Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.2-0.20210308182858-d24f14f8be70 | - |
Fixed versions
| 1.1.2-0.20210308182858-d24f14f8be70 |
Sources
- osv: GO-2022-1178
- https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgr
- https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3e
- https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation
CVE-2022-39304 · published · modified · JSON