lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

HIGHGHSA-28q9-9c3g-v3f9 · GO-2022-1019 · Published 23/09/2022 · updated 21/08/2024

In short

GHSA-28q9-9c3g-v3f9 is a HIGH vulnerability affecting github.com/treeverse/lakefs.
Fix: update to 0.82.0 or later.

Package	Affected versions	Patched versions
github.com/treeverse/lakefs Go	`< 0.82.0`	`0.82.0`

Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.

lakeFS v0.82.0 and later

Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".

If you have any questions or comments about this advisory:

Ask on the lakeFS Slack #help channel Email us at [email protected]

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 0.82.0

0.82.0

Description

Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.

lakeFS v0.82.0 and later

Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".

If you have any questions or comments about this advisory:

Ask on the lakeFS Slack #help channel Email us at [email protected]

More vulnerabilities in github.com/treeverse/lakefs

See all →