| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/runatlantis/atlantis | < 0.19.7 | 0.19.7 |
| atlantis | < 0.19.7 | 0.19.7 |
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free