GHSA-f3fj-9625-rv3m: charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. SetPrivate cleared the cached record before it saved the new visibility, and not afterwards.
A request that arrived between the two read the old, public record from the database and cached it after the change was saved. From then on every access check used that stale record, so a repository the operator had just made private stayed readable by unauthenticated users over HTTP, SSH, and git:// until the server restarted.
References
- github.com/advisories/GHSA-f3fj-9625-rv3m
- github.com/charmbracelet/soft-serve/commit/0a4e6f0b7e063927c7128756e1c1b3db871edabf
- github.com/charmbracelet/soft-serve/commit/5b307b4da4db285f797cc028b381ba4d3d853019
- github.com/charmbracelet/soft-serve/commit/e398b4dde723437f637b06710e0938d349b360e8
- github.com/charmbracelet/soft-serve/releases/tag/v0.12.3
- github.com/charmbracelet/soft-serve/security/advisories/GHSA-f3fj-9625-rv3m
Code Behaviors & Features
Detect and mitigate GHSA-f3fj-9625-rv3m with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →