GHSA-735r-hv67-g38f
vitess allows users to create keyspaces that can deny access to already existing keyspaces
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | vitess.io/vitess | < 0.16.1 | 0.16.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error.
Note that all other keyspaces can still be administered using the CLI (vtctldclient).
### Patches
v16.0.1 (corresponding to 0.16.1 on pkg.go.dev)
### Workarounds
Delete the offending keyspace using a CLI client (vtctldclient)
```
vtctldclient --server ... DeleteKeyspace a/b
```
Found during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).
References
External links from the advisory. They lead to third-party sites.