Description
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | kallithea | < 0.2 | 0.2 | GHSA-hhx9-4vw2-x54r |
| PyPI | rhodecode | < 2.2.7 | 2.2.7 | GHSA-hhx9-4vw2-x54r |
References
- https://kallithea-scm.org/security/cve-2015-0260.html
- https://rhodecode.com/blog/rhodecode-enterprise-security-release/
- kallithea-cve20150260-info-disc(100888) vdb-entry
- 72573 vdb-entry
- [oss-security] 20150210 CVE-2015-0260: Kallithea: API key of repository's creator exposed by get_repo API method mailing-list