Is CVE-2024-29296 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-29296 being exploited in the wild.

How severe is CVE-2024-29296?

Medium severity, with a CVSS score of 5.3, published 10 April 2024.

Which products and versions are affected?

github.com/portainer/portainer (Go) < 0.6.1-0.20240417040827-48bc7d0d92f0, SEMVER:introduced=0,fixed=0.6.1-0.20240417040827-48bc7d0d92f0; Portainer CE before 2.19.5 and 2.20.2.

Is there a fix for CVE-2024-29296?

Yes. github.com/portainer/portainer (Go): upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-29296 attacked?

It is attacked over the network.

Am I affected by CVE-2024-29296?

Check whether you run github.com/portainer/portainer (Go) or Portainer CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29296: Portainer CE username enumeration through authentication response timing

Q: Is there a fix for CVE-2024-29296?

Yes. github.com/portainer/portainer (Go): upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-29296 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2024-29296?

Check whether you run github.com/portainer/portainer (Go) or Portainer CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29296 · Severity: medium · CVSS 5.3 · Published 2024-04-10

Portainer CE is a container management platform used to administer Docker and Kubernetes environments. A timing-based vulnerability in its authentication process allows an unauthenticated attacker to determine which usernames exist in the system by measuring differences in authentication response times, potentially enabling account targeting for brute-force attacks.

Technologies: github.com/portainer/portainer (Go), Portainer CE. Vendors: Go, Portainer.

Quick answers

Is CVE-2024-29296 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-29296 being exploited in the wild.
How severe is CVE-2024-29296?: Medium severity, with a CVSS score of 5.3, published 10 April 2024.
Which products and versions are affected?: github.com/portainer/portainer (Go) < 0.6.1-0.20240417040827-48bc7d0d92f0, SEMVER:introduced=0,fixed=0.6.1-0.20240417040827-48bc7d0d92f0; Portainer CE before 2.19.5 and 2.20.2.
Is there a fix for CVE-2024-29296?: Yes. github.com/portainer/portainer (Go): upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-29296 attacked?: It is attacked over the network.
Am I affected by CVE-2024-29296?: Check whether you run github.com/portainer/portainer (Go) or Portainer CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/portainer/portainer (Go): upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 or later
```
go get github.com/portainer/portainer@v0.6.1-0.20240417040827-48bc7d0d92f0
```

Technical details

A user enumeration vulnerability exists in Portainer CE's authentication handler where response timing differs based on whether a username exists. An unauthenticated remote attacker can exploit this timing side-channel to discover valid usernames without requiring authentication. The vulnerability is addressed in commits after version 2.19.4.

Affected products

Portainer Portainer CE before 2.19.5 and 2.20.2

Identifiers

CVE-2024-29296
GHSA-87x6-8m9v-g8c2
GO-2026-6619

Timeline

2024-04-10: disclosed
2024-04-17: patched

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.