GHSA-ggp5-28x4-xcj9MediumCVSS 4.3

Minder GetRepositoryByName data leak

Published
April 9, 2024
Last Modified
April 9, 2024

🔗 CVE IDs covered (1)

CVE-2024-31455 →

📋 Description

Impact

A recent refactoring added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository.

Patches

Patched in #2941

Workarounds

Revert prior to 5c381cf, or roll forward past 2eb94e7

References

N/A

🎯 Affected products1

  • go/github.com/stacklok/minder:= 0.0.39

🔗 References (6)