GHSA-hh33-46q4-hwm2

Source

https://github.com/advisories/GHSA-hh33-46q4-hwm2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-hh33-46q4-hwm2/GHSA-hh33-46q4-hwm2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hh33-46q4-hwm2

Aliases

CVE-2024-43784
GO-2024-3291

Published

2024-11-26T19:58:20Z

Modified

2024-11-27T19:42:06.784799Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L CVSS Calculator
6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

Details

Impact

Existing lakeFS users who have issued credentials to users who have been deleted. Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

A possible workaround will be not to reuse usernames that were previously deleted

References

Are there any links users can visit to find out more?

Database specific

{
    "nvd_published_at": "2024-11-26T21:15:07Z",
    "cwe_ids": [
        "CWE-281",
        "CWE-287"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-26T19:58:20Z"
}

References

Affected packages

Go / github.com/treeverse/lakefs

Package

Name: github.com/treeverse/lakefs; View open source insights on deps.dev
Purl: pkg:golang/github.com/treeverse/lakefs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.33.0