CVE-2022-24912

    Dashboard / Vulnerabilities / CVE-2022-24912

    CVE-2022-24912

    Published: 29 Jul 2022Last Modified: 12 Aug 2026

    Summary: Timing Attack

    Details: The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.

    References: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUNATLANTISATLANTISSERVERCONTROLLERSEVENTS-2950851, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24912.json, https://nvd.nist.gov/vuln/detail/CVE-2022-24912, https://github.com/runatlantis/atlantis/issues/2391, https://github.com/runatlantis/atlantis/commit/48870911974adddaa4c99c8089e79b7d787fa820

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -700cffd57ddc12c456e1094f5a60f7d61c86c4db

    Affected versions

    v0.19.7-pre.20220713
    v0.19.6
    v0.19.5
    v0.19.5-pre.20220628
    v0.19.5-pre.20220622
    v0.19.5-pre.20220616
    v0.19.4
    v0.19.4-pre.20220513
    v0.19.3
    v0.19.3-pre.20220429
    v0.19.3-pre.20220408
    v0.19.2-pre.20220408
    v0.19.2
    v0.19.1
    v0.19.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24912 | CVE-DB