Tóm tắt nhanh
- CVE-2025-64179 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng github.com/treeverse/lakefs.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.29%, cao hơn 21.4% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.71.0 hoặc mới hơn.
Mô tả
Impact
Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime.
Patches
Upgrade to >v1.70.1
Workarounds
Any ONE of these is sufficient to block this reporting:
- Disable usage reporting by setting configuration option
usage_report.enabled or environment variable LAKEFS_USAGE_REPORT_ENABLED to false.
- Using load-balancer or application level firewall - blocking the request route /api/v1/usage-report/summary.
Mô tả của NVD
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí