CVE-2024-56802

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-56802

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56802.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-56802

Aliases

GHSA-rj9m-qf65-f5gg

Published

2024-12-31T15:10:42Z

Modified

2026-10-28T10:42:17Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Tapir allows DeployKey exposure

Details

Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key to get write access to the registry. User must upgrade to 0.9.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-285"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56802.json"
}

References

Affected packages

Git / github.com/pacovk/tapir

Affected ranges

Type

GIT

Repo

https://github.com/pacovk/tapir

Events

Introduced

eab0c28e0596d3b0f44726d5be2c6f34bb942d5e

Fixed

98c0d5d45dedaec431bfbc0ad8004605aaa98a3b

Fixed

c36360b611fa0ba4f5e250fa43ecf8a294785a03

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.9.0"
                },
                {
                    "fixed":  "0.9.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "c36360b611fa0ba4f5e250fa43ecf8a294785a03"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.9.0

0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56802.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "297381013022121512573804595585577762160",
                "242028227777347796155598953785864486414",
                "96468947976714823752871244939925139135",
                "327213229627847233911885569828335488180",
                "53132915712777742580085731998477288816",
                "293139631114140547300852059049512155281",
                "168837994508231466641860279217177514835"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-56802-2170b112",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/main/java/core/backend/aws/dynamodb/repository/DynamodbRepository.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "126597179216779494238743627527458362254",
            "length":  83
        },
        "id":  "CVE-2024-56802-2498490e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/test/java/core/backend/elasticsearch/ElasticSearchDeployKeyRepositoryTest.java",
            "function":  "ElasticSearchDeployKeyRepositoryTest"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "121866480911485348781116892505029045750",
                "95512849475238292431935926253093258203",
                "51508406429472723723425077010143395542",
                "10569821427838697879347421322492072253",
                "234237656180845233009564602626239515724",
                "21339510619622035817713930714849578954",
                "75057756502644034284527547172839180889",
                "134191718912185367170146011604907125025",
                "235183150848954380683688880152662825036"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-56802-28591e40",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/test/java/core/backend/aws/dynamodb/repository/DynamodbDeployKeyRepositoryTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2903008248997953758430371242643259712",
            "length":  423
        },
        "id":  "CVE-2024-56802-44273887",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/main/java/core/backend/elasticsearch/ElasticSearchRepository.java",
            "function":  "getDeployKeyByValue"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2903008248997953758430371242643259712",
            "length":  423
        },
        "id":  "CVE-2024-56802-95826b55",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/main/java/core/backend/azure/cosmosdb/CosmosDbRepository.java",
            "function":  "getDeployKeyByValue"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "320424734409450669530793812280477139602",
                "40425595250960475851519530153802092992",
                "235472904201156620245019270010148704833",
                "84683892461241179645875629542561505648",
                "162143082969862065063511116514690558182",
                "301650189815931039860548219696553360685",
                "111777762361908312160618375793600958084",
                "144590895295525034915384930541372351385",
                "303346937916298136624018912208726038047",
                "254435855423672949509071235532833430445",
                "145003253974385750944803192376857654808",
                "152342587178253801587168974879847789601",
                "182393773895661440505273694342921039000",
                "65970463622645848708331594113734141235",
                "161859167012052033199544933111518891182",
                "285241820126465982716967219612273000105",
                "256221140875901368732339198773072876083"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-56802-b312129e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/test/java/core/backend/elasticsearch/ElasticSearchDeployKeyRepositoryTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "251587189718603857352491131134689695298",
            "length":  334
        },
        "id":  "CVE-2024-56802-c81687ee",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/main/java/core/backend/aws/dynamodb/repository/DynamodbRepository.java",
            "function":  "getDeployKeyByValue"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "159905437562022779377760779643327188977",
                "47811228824363961212055204127206751336",
                "96468947976714823752871244939925139135",
                "327213229627847233911885569828335488180",
                "219078832801944922326397025997903795115",
                "116635715027649493880325577431038755537",
                "310231677560505903606317690313720563782"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-56802-dfe61ac9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/main/java/core/backend/azure/cosmosdb/CosmosDbRepository.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "159597264638679598128961085512237459940",
                "179034492708752083383966237876110282951",
                "159905437562022779377760779643327188977",
                "47811228824363961212055204127206751336",
                "96468947976714823752871244939925139135",
                "327213229627847233911885569828335488180",
                "219078832801944922326397025997903795115",
                "116635715027649493880325577431038755537",
                "310231677560505903606317690313720563782",
                "116715091168462142911167922075636346234",
                "40955257031539867966530441998448383405",
                "252365025258527448522203196490852378290"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-56802-f59c57aa",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "target":  {
            "file":  "src/main/java/core/backend/elasticsearch/ElasticSearchRepository.java"
        }
    }
]

vanir_signatures_modified

"2026-10-28T10:42:17Z"