CVE-2024-56802

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-56802

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56802.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-56802

Aliases

GHSA-rj9m-qf65-f5gg

Published

2024-12-31T15:10:42.511Z

Modified

2026-07-22T03:35:54.792985Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Tapir allows DeployKey exposure

Details

Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key to get write access to the registry. User must upgrade to 0.9.2.

Database specific

{
    "cwe_ids": [
        "CWE-285"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56802.json"
}

References

Affected packages

Git / github.com/pacovk/tapir

Affected ranges

Type

GIT

Repo

https://github.com/pacovk/tapir

Events

Introduced

eab0c28e0596d3b0f44726d5be2c6f34bb942d5e

Fixed

c36360b611fa0ba4f5e250fa43ecf8a294785a03

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.9.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.9.0

0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56802.json"

vanir_signatures_modified

"2026-07-22T03:35:54Z"

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "297381013022121512573804595585577762160",
                "242028227777347796155598953785864486414",
                "96468947976714823752871244939925139135",
                "327213229627847233911885569828335488180",
                "53132915712777742580085731998477288816",
                "293139631114140547300852059049512155281",
                "168837994508231466641860279217177514835"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2024-56802-2170b112",
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/core/backend/aws/dynamodb/repository/DynamodbRepository.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "length": 83.0,
            "function_hash": "126597179216779494238743627527458362254"
        },
        "signature_type": "Function",
        "id": "CVE-2024-56802-2498490e",
        "signature_version": "v1",
        "target": {
            "function": "ElasticSearchDeployKeyRepositoryTest",
            "file": "src/test/java/core/backend/elasticsearch/ElasticSearchDeployKeyRepositoryTest.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "121866480911485348781116892505029045750",
                "95512849475238292431935926253093258203",
                "51508406429472723723425077010143395542",
                "10569821427838697879347421322492072253",
                "234237656180845233009564602626239515724",
                "21339510619622035817713930714849578954",
                "75057756502644034284527547172839180889",
                "134191718912185367170146011604907125025",
                "235183150848954380683688880152662825036"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2024-56802-28591e40",
        "signature_version": "v1",
        "target": {
            "file": "src/test/java/core/backend/aws/dynamodb/repository/DynamodbDeployKeyRepositoryTest.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "length": 423.0,
            "function_hash": "2903008248997953758430371242643259712"
        },
        "signature_type": "Function",
        "id": "CVE-2024-56802-44273887",
        "signature_version": "v1",
        "target": {
            "function": "getDeployKeyByValue",
            "file": "src/main/java/core/backend/elasticsearch/ElasticSearchRepository.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "length": 423.0,
            "function_hash": "2903008248997953758430371242643259712"
        },
        "signature_type": "Function",
        "id": "CVE-2024-56802-95826b55",
        "signature_version": "v1",
        "target": {
            "function": "getDeployKeyByValue",
            "file": "src/main/java/core/backend/azure/cosmosdb/CosmosDbRepository.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "320424734409450669530793812280477139602",
                "40425595250960475851519530153802092992",
                "235472904201156620245019270010148704833",
                "84683892461241179645875629542561505648",
                "162143082969862065063511116514690558182",
                "301650189815931039860548219696553360685",
                "111777762361908312160618375793600958084",
                "144590895295525034915384930541372351385",
                "303346937916298136624018912208726038047",
                "254435855423672949509071235532833430445",
                "145003253974385750944803192376857654808",
                "152342587178253801587168974879847789601",
                "182393773895661440505273694342921039000",
                "65970463622645848708331594113734141235",
                "161859167012052033199544933111518891182",
                "285241820126465982716967219612273000105",
                "256221140875901368732339198773072876083"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2024-56802-b312129e",
        "signature_version": "v1",
        "target": {
            "file": "src/test/java/core/backend/elasticsearch/ElasticSearchDeployKeyRepositoryTest.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "length": 334.0,
            "function_hash": "251587189718603857352491131134689695298"
        },
        "signature_type": "Function",
        "id": "CVE-2024-56802-c81687ee",
        "signature_version": "v1",
        "target": {
            "function": "getDeployKeyByValue",
            "file": "src/main/java/core/backend/aws/dynamodb/repository/DynamodbRepository.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "159905437562022779377760779643327188977",
                "47811228824363961212055204127206751336",
                "96468947976714823752871244939925139135",
                "327213229627847233911885569828335488180",
                "219078832801944922326397025997903795115",
                "116635715027649493880325577431038755537",
                "310231677560505903606317690313720563782"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2024-56802-dfe61ac9",
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/core/backend/azure/cosmosdb/CosmosDbRepository.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "159597264638679598128961085512237459940",
                "179034492708752083383966237876110282951",
                "159905437562022779377760779643327188977",
                "47811228824363961212055204127206751336",
                "96468947976714823752871244939925139135",
                "327213229627847233911885569828335488180",
                "219078832801944922326397025997903795115",
                "116635715027649493880325577431038755537",
                "310231677560505903606317690313720563782",
                "116715091168462142911167922075636346234",
                "40955257031539867966530441998448383405",
                "252365025258527448522203196490852378290"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2024-56802-f59c57aa",
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/core/backend/elasticsearch/ElasticSearchRepository.java"
        },
        "source": "https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03",
        "deprecated": false
    }
]