CVE-2022-34296: Query predicate bypass in Zalando Skipper

June 23, 2022 (updated August 8, 2023)

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

References

github.com/advisories/GHSA-qx2j-85q5-ffp8
github.com/zalando/skipper/pull/2028
github.com/zalando/skipper/releases/tag/v0.13.218
nvd.nist.gov/vuln/detail/CVE-2022-34296

Code Behaviors & Features

Detect and mitigate CVE-2022-34296 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →