CVE-2024-34084
Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests to `HandleGithubWebhook` to crash the Minder controlplane and deny other users from using it. This vulnerability is fixed in 0.0.48.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.59% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Source
- security-advisories@github.com
References
- https://github.com/stacklok/minder/commit/3e5a527d2f1b535159206161d1d519602c75bd0d
- https://github.com/stacklok/minder/security/advisories/GHSA-9c5w-9q3f-3hv7
- https://github.com/stacklok/minder/commit/3e5a527d2f1b535159206161d1d519602c75bd0d
- https://github.com/stacklok/minder/security/advisories/GHSA-9c5w-9q3f-3hv7
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.