CVE-2024-25125: Absolute path traversal vulnerability in digdag server

February 14, 2024 (updated October 21, 2024)

Treasure Data’s digdag workload automation system is susceptible to a path traversal vulnerability if it’s configured to store log files locally.

References

github.com/advisories/GHSA-5mp4-32rr-v3x5
github.com/treasure-data/digdag
github.com/treasure-data/digdag/commit/eae89b0daf6c62f12309d8c7194454dfb18cc5c3
github.com/treasure-data/digdag/security/advisories/GHSA-5mp4-32rr-v3x5
nvd.nist.gov/vuln/detail/CVE-2024-25125

Code Behaviors & Features

Detect and mitigate CVE-2024-25125 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →