Information Exposure Affecting github.com/stacklok/minder/internal/db package, versions <0.0.40
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMSTACKLOKMINDERINTERNALDB-6594229
- published 10 Apr 2024
- disclosed 9 Apr 2024
- credit Eleftheria Stein-Kousathana
Introduced: 9 Apr 2024
New CVE-2024-31455 Open this link in a new tabHow to fix?
Upgrade github.com/stacklok/minder/internal/db to version 0.0.40 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure due to a refactoring error in the SQL query construction, which lacked the necessary parenthesis, resulting in the selection of a random repository instead of the intended one. An attacker can exploit this flaw to access information from unintended repositories by leveraging the flawed query.
Workaround
This vulnerability can be mitigated by reverting to a version prior to 5c381cf, or updating to a version beyond 2eb94e7.