GHSA-28q9-9c3g-v3f9

    Dashboard / Vulnerabilities / GHSA-28q9-9c3g-v3f9

    GHSA-28q9-9c3g-v3f9

    Published: 23 Sept 2022Last Modified: 21 Aug 2024
    Aliases:
    GO-2022-1019

    Summary: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

    Details: ### Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. ### Patches lakeFS v0.82.0 and later ### Workarounds Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS". ### References [advisories/GHSA-28q9-9c3g-v3f9](https://github.com/treeverse/lakeFS/security/advisories/GHSA-28q9-9c3g-v3f9) ### For more information If you have any questions or comments about this advisory: Ask on the [lakeFS Slack](https://github.com/treeverse/lakeFS/security/advisories/lakefs.io/slack) #help channel Email us at [[email protected]](mailto:[email protected])

    References: https://github.com/treeverse/lakeFS/security/advisories/GHSA-28q9-9c3g-v3f9, https://github.com/treeverse/lakeFS/commit/81182bf9c0cf57f3cec3c893cf739b2069305e37, https://github.com/treeverse/lakeFS

    Affected packages

    Package

    Name: github.com/treeverse/lakefs

    Purl: pkg:golang/github.com/treeverse/lakefs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.82.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-28q9-9c3g-v3f9 | CVE-DB