~ / search / GHSA-g5q2-cxgq-h2rw

GHSA-g5q2-cxgq-h2rw

Information leak in Gerrit

Source: GitHub Advisory Database (reviewed) Low CVE-2020-8920

Packages

EcosystemPackageAffectedFixed in
Maven com.google.gerrit:gerrit-plugin-api < 2.14.22 2.14.22
Maven com.google.gerrit:gerrit-plugin-api >= 2.15.0, < 2.15.21 2.15.21
Maven com.google.gerrit:gerrit-plugin-api >= 2.16.0, < 2.16.25 2.16.25
Maven com.google.gerrit:gerrit-plugin-api >= 3.0.0, < 3.0.15 3.0.15
Maven com.google.gerrit:gerrit-plugin-api >= 3.1.0, < 3.1.10 3.1.10
Maven com.google.gerrit:gerrit-plugin-api >= 3.2.0, < 3.2.5 3.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.

References

External links from the advisory. They lead to third-party sites.