stacklok minder up to 0.0.52 404 Error input validation

Summaryinfo

A vulnerability has been found in stacklok minder and classified as problematic. This affects an unknown part of the component 404 Error Handler. Performing a manipulation results in input validation. This vulnerability is reported as CVE-2024-27093. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in stacklok minder. This affects an unknown part of the component 404 Error Handler. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity, and availability. The summary by CVE is:

Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database). When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result. Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully. Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability. This vulnerability is patched in version 0.20240226.1425+ref.53868a8.

The weakness was disclosed 02/27/2024 as GHSA-q6h8-4j2v-pjg4. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-27093 since 02/19/2024. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.20240226.1425+ref.53868a8 eliminates this vulnerability. Applying the patch 53868a878e93f29c43437f96dbc990b548e48d1d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• stacklok

Name

• minder

Version

• 0.0.39
• 0.0.48
• 0.0.49
• 0.0.50
• 0.0.51
• 0.0.52

License

• open-source

Website

• Product: https://github.com/stacklok/minder/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion