Skip to content
OpenAdvisories
High · 7.5 CVE-2024-34084 EUVD-2024-1551GHSA-9c5w-9q3f-3hv7GO-2024-2821

Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests

Published May 7, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests to `HandleGithubWebhook` to crash the Minder controlplane and deny other users from using it. This vulnerability is fixed in 0.0.48.

Affected products

VendorProductAffectedFixed
stacklok minder < 0.0.48 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/stacklok/minder < 0.0.48 0.0.48 GHSA-9c5w-9q3f-3hv7

References