GHSA-jxqv-jcvh-7gr4

Source

https://github.com/advisories/GHSA-jxqv-jcvh-7gr4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-jxqv-jcvh-7gr4/GHSA-jxqv-jcvh-7gr4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jxqv-jcvh-7gr4

Aliases

Related

Published

2022-07-30T00:00:41Z

Modified

2024-05-20T21:28:30Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Atlantis Events vulnerable to Timing Attack

Details

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.

Database specific

{
    "nvd_published_at": "2022-07-29T10:15:00Z",
    "cwe_ids": [
        "CWE-203",
        "CWE-208"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-06T05:21:43Z"
}

References

Affected packages

Go / github.com/runatlantis/atlantis

Package

Name: github.com/runatlantis/atlantis; View open source insights on deps.dev
Purl: pkg:golang/github.com/runatlantis/atlantis

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.19.7