lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

高GHSA-28q9-9c3g-v3f9 · GO-2022-1019 · 23/09/2022 公開 · 21/08/2024 更新

要点

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/treeverse/lakefs Go	`< 0.82.0`	`0.82.0`

Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.

lakeFS v0.82.0 and later

Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".

If you have any questions or comments about this advisory:

Ask on the lakeFS Slack #help channel Email us at [email protected]

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

< 0.82.0

0.82.0

概要

Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.

lakeFS v0.82.0 and later

Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".

If you have any questions or comments about this advisory:

Ask on the lakeFS Slack #help channel Email us at [email protected]

github.com/treeverse/lakefs のその他の脆弱性

すべて見る →