Vulnerability · Published Jan 4, 2021 · Assigned by GitHub_M

CVE-2020-26294Exposure of server configuration

High 7.4

In plain English

A high-severity OS command injection in compiler from go-vela. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)1.8%top 21.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/go-vela/compiler	0.6.1	GHSA-gv2h-gf8m-r68j
Go	github.com/go-vela/compiler	0.6.1	GO-2022-0838

Affected products (as reported)

Vendor	Product	Versions
go-vela	compiler	< 0.6.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68j x_refsource_CONFIRM
https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bda x_refsource_MISC
https://pkg.go.dev/github.com/go-vela/compiler/compiler x_refsource_MISC