Vulnerability · Published Apr 9, 2021 · Assigned by GitHub_M
CVE-2021-21432Reject unauthorized access with GitHub PATs
High 7.5
In plain English
A high-severity security flaw in server from go-vela. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/go-vela/server | 0.7.5 | GHSA-8j3f-mhq8-gmh4 |
| Go | github.com/go-vela/server | 0.7.5 | GO-2022-0812 |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
References
- https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4 x_refsource_CONFIRM
- https://pkg.go.dev/github.com/go-vela/server x_refsource_MISC
- https://github.com/go-vela/server/releases/tag/v0.7.5 x_refsource_MISC
- https://github.com/go-vela/server/pull/337 x_refsource_MISC
- https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46 x_refsource_MISC