CVE-2024-34084: fallo de gravedad alta en stacklok minder
Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.6%
Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests to `HandleGithubWebhook` to crash the Minder controlplane and deny other users from using it. This vulnerability is fixed in 0.0.48.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
stacklok · minderCVEs relacionadas — stacklok minder
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-31455MEDIUMMinder GetRepositoryByName data leakEPSS 0.8%CVE-2024-27916HIGH`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated userEPSS 0.7%CVE-2024-27093MEDIUMMinder trusts client-provided mapping from repo name to upstream IDEPSS 0.6%CVE-2024-35238MEDIUMDenial of service of Minder Server from maliciously crafted GitHub attestationsEPSS 0.5%CVE-2024-35185MEDIUMDenial of service of Minder Server with attacker-controlled REST endpointEPSS 0.5%CVE-2024-37904MEDIUMDenial of service from maliciously configured Git repository in MinderEPSS 0.5%