User with permission to write actions can impersonate another user when auth token is configured in environment variable

中 6.2GHSA-26hr-q2wp-rvc5 · GO-2023-2397 · 12/12/2023 公開 · 21/08/2024 更新

要点

GHSA-26hr-q2wp-rvc5 は github.com/treeverse/lakefs に影響する深刻度「中」 (CVSS 6.2) の脆弱性です。
対処：1.3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/treeverse/lakefs Go	`< 1.3.1`	`1.3.1`

When lakeFS is configured with ALL of the following:

Configuration option auth.encrypt.secret_key passed through environment variable
Actions enabled via configuration option actions.enabled (default enabled)

then a user who can configure an action can impersonate any other user.

Has the problem been patched? What versions should users upgrade to?

ANY ONE of these is sufficient to prevent the issue:

Do not pass auth.encrypt.secret_key through an environment variable.

For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

< 1.3.1

1.3.1

概要

When lakeFS is configured with ALL of the following:

Configuration option auth.encrypt.secret_key passed through environment variable
Actions enabled via configuration option actions.enabled (default enabled)

then a user who can configure an action can impersonate any other user.

Has the problem been patched? What versions should users upgrade to?

ANY ONE of these is sufficient to prevent the issue:

Do not pass auth.encrypt.secret_key through an environment variable.

For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.

github.com/treeverse/lakefs のその他の脆弱性

すべて見る →