CVE-2024-27916
2 advisories.
Go/github.com/stacklok/minder CVE-2024-27916: high 7.1, EPSS 0.67%
`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user
Action: Upgrade github.com/stacklok/minder to 0.0.33 or later.
go get github.com/stacklok/minder@v0.0.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.33 | - |
Fixed versions
| 0.0.33 |
Sources
- osv: GHSA-v627-69v2-xx37
- https://github.com/stacklok/minder/security/advisories/GHSA-v627-69v2-xx37
- https://nvd.nist.gov/vuln/detail/CVE-2024-27916
- https://github.com/stacklok/minder/commit/45750b4e9fb2de33365758366e06c19e999bd2eb
- https://github.com/stacklok/minder
- https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/handlers_repositories.go#L277-L278
- https://github.com/stacklok/minder/blob/main/internal/controlplane/handlers_repositories.go#L257-L299
CVE-2024-27916 · published · modified · JSON
Go/github.com/stacklok/minder CVE-2024-27916: unknown, EPSS 0.67%
Minder access control bypass in github.com/stacklok/minder
Action: Upgrade github.com/stacklok/minder to 0.0.33 or later.
go get github.com/stacklok/minder@v0.0.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.33 | - |
Fixed versions
| 0.0.33 |
Sources
- osv: GO-2024-2608
- https://github.com/stacklok/minder/security/advisories/GHSA-v627-69v2-xx37
- https://github.com/stacklok/minder/commit/45750b4e9fb2de33365758366e06c19e999bd2eb
CVE-2024-27916 · published · modified · JSON