GHSA-HH33-46Q4-HWM2

Vulnerability from github – Published: 2024-11-26 19:58 – Updated: 2024-11-26 21:43
VLAI?
Summary
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion
Details

Impact

Existing lakeFS users who have issued credentials to users who have been deleted. Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

A possible workaround will be not to reuse usernames that were previously deleted

References

Are there any links users can visit to find out more?

Severity ?
5.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
6.8 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/treeverse/lakefs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43784"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-281",
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-26T19:58:20Z",
    "nvd_published_at": "2024-11-26T21:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nExisting lakeFS users who have issued credentials to users who have been deleted.\nCreating a new user with the same username, that user will inherit all of the previous user\u0027s credentials lakeFS needs to delete user credentials upon user deletion.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\nA possible workaround will be not to reuse usernames that were previously deleted\n\n### References\n_Are there any links users can visit to find out more?_\n",
  "id": "GHSA-hh33-46q4-hwm2",
  "modified": "2024-11-26T21:43:45Z",
  "published": "2024-11-26T19:58:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-hh33-46q4-hwm2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43784"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/treeverse/lakeFS"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/releases/tag/v1.33.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.