GHSA-ggp5-28x4-xcj9: Minder GetRepositoryByName data leak

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-31455

Minder GetRepositoryByName data leak

Moderate severity GitHub Reviewed Published Apr 9, 2024 in stacklok/minder • Updated Apr 9, 2024

Package

gomod github.com/stacklok/minder (Go)

Affected versions

= 0.0.39

Description

Impact

A recent refactoring added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository.

Patches

Patched in #2941

Workarounds

Revert prior to 5c381cf, or roll forward past 2eb94e7

References

N/A

References

• GHSA-ggp5-28x4-xcj9
• stacklok/minder#2941
• stacklok/minder@11b6573
• stacklok/minder@5c381cf

Published to the GitHub Advisory Database

Apr 9, 2024