요약
- CVE-2025-64179은(는) github.com/treeverse/lakefs에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.29%, 전체 취약점의 21.4%보다 높음.
- 조치: 1.71.0 이상으로 업데이트하세요.
Description
Impact
Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime.
Patches
Upgrade to >v1.70.1
Workarounds
Any ONE of these is sufficient to block this reporting:
- Disable usage reporting by setting configuration option
usage_report.enabled or environment variable LAKEFS_USAGE_REPORT_ENABLED to false.
- Using load-balancer or application level firewall - blocking the request route /api/v1/usage-report/summary.
NVD description
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.
github.com/treeverse/lakefs의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free