~ / search / GHSA-4fqx-74rv-638w

GHSA-4fqx-74rv-638w

Pivotal Concourse SQL Injection Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2019-3792

Packages

EcosystemPackageAffectedFixed in
Go github.com/concourse/concourse < 5.0.1 5.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

References

External links from the advisory. They lead to third-party sites.