CVE-2024-27093: Minder trusts client-provided mapping from repo name to upstream ID

February 26, 2024 (updated February 5, 2025)

When using a modified client or the grpc interface directly, the RegisterRepository call accepts both the repository owner / repo and the repo_id. Furthermore, these two are not checked for matching before registering webhooks and data in the database.

References

github.com/advisories/GHSA-q6h8-4j2v-pjg4
github.com/stacklok/minder
github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d
github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4
nvd.nist.gov/vuln/detail/CVE-2024-27093
pkg.go.dev/vuln/GO-2024-2582

Code Behaviors & Features

Detect and mitigate CVE-2024-27093 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →