要点
- CVE-2025-64179 は github.com/treeverse/lakefs に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.29%（全脆弱性の 21.4% より高い）。
- 対処：1.71.0 以降に更新してください。
概要
Impact
Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime.
Patches
Upgrade to >v1.70.1
Workarounds
Any ONE of these is sufficient to block this reporting:
- Disable usage reporting by setting configuration option
usage_report.enabled or environment variable LAKEFS_USAGE_REPORT_ENABLED to false.
- Using load-balancer or application level firewall - blocking the request route /api/v1/usage-report/summary.
NVD の説明
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.
github.com/treeverse/lakefs のその他の脆弱性
すべて見る →これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン