En bref
- CVE-2025-64179 est une vulnérabilité MOYENNE (CVSS 5.3) touchant github.com/treeverse/lakefs.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.29%, plus élevée que 21.4% des vulnérabilités.
- Correctif : mettre à jour vers 1.71.0 ou plus récent.
Description
Impact
Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime.
Patches
Upgrade to >v1.70.1
Workarounds
Any ONE of these is sufficient to block this reporting:
- Disable usage reporting by setting configuration option
usage_report.enabled or environment variable LAKEFS_USAGE_REPORT_ENABLED to false.
- Using load-balancer or application level firewall - blocking the request route /api/v1/usage-report/summary.
NVD description
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.
Autres vulnérabilités de github.com/treeverse/lakefs
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free