CVE-2022-24912: Observable Discrepancy

July 30, 2022 (updated August 9, 2022)

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.

References

github.com/advisories/GHSA-jxqv-jcvh-7gr4
github.com/runatlantis/atlantis/commit/48870911974adddaa4c99c8089e79b7d787fa820
github.com/runatlantis/atlantis/issues/2391
nvd.nist.gov/vuln/detail/CVE-2022-24912
security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUNATLANTISATLANTISSERVERCONTROLLERSEVENTS-2950851

Code Behaviors & Features

Detect and mitigate CVE-2022-24912 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →