GHSA-hh33-46q4-hwm2
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/treeverse/lakefs | < 1.33.0 | 1.33.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Existing lakeFS users who have issued credentials to users who have been deleted.
Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
### Workarounds
A possible workaround will be not to reuse usernames that were previously deleted
### References
_Are there any links users can visit to find out more?_
References
External links from the advisory. They lead to third-party sites.