Executive brief
Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder
Affected products
- Go github.com/stacklok/minder
Junglewise Threat Intelligence
CVE-2024-27093: GO-2024-2582 - Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder
CVE-2024-27093 · Severity: low · CVSS 3.1 · Published 2024-06-28
Technologies: github.com/stacklok/minder (Go). Vendors: Go.
Related threats
- GO-2024-2934 - Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder
- GO-2024-2871 - Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder
- GO-2024-2885 - Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder
- GO-2024-2701 - Minder GetRepositoryByName data leak in github.com/stacklok/minder
- GO-2024-2864 - Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder