Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/stacklok/minder

8 known vulnerabilities (2 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 6 medium
Registry
pkg.go.dev

Advisories 8

  • CVE-2024-37904Medium 5.7

    Denial of service from maliciously configured Git repository in Minder

    Affected: fixed in 0.0.52.

  • CVE-2024-35238Medium 5.3

    Denial of service of Minder Server from maliciously crafted GitHub attestations

    Affected: fixed in 0.0.51.

  • CVE-2024-35194Medium 5.3

    Stacklok Minder vulnerable to denial of service from maliciously crafted templates

    Affected: fixed in 0.0.50.

  • CVE-2024-35185Medium 5.3

    Denial of service of Minder Server with attacker-controlled REST endpoint

    Affected: fixed in 0.0.49.

  • Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests

    Affected: fixed in 0.0.48.

  • CVE-2024-31455Medium 4.3

    Minder GetRepositoryByName data leak

    Affected: from 0.0.39, fixed in 0.0.40; from 0.0.39, fixed in 0.0.40.

  • `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any…

    Affected: fixed in 0.0.33.

  • CVE-2024-27093Medium 4.6

    Minder trusts client-provided mapping from repo name to upstream ID

    Affected: fixed in 0.20240226.1425; all versions.