CVE-2024-35185: Denial of service of Minder Server with attacker-controlled REST endpoint

May 16, 2024

The Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server.

References

github.com/advisories/GHSA-fjw8-3gp8-4cvx
github.com/stacklok/minder
github.com/stacklok/minder/commit/065049336aac0621ee00a0bb2211f8051d47c14b
github.com/stacklok/minder/security/advisories/GHSA-fjw8-3gp8-4cvx
nvd.nist.gov/vuln/detail/CVE-2024-35185

Code Behaviors & Features

Detect and mitigate CVE-2024-35185 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →