~ / search / GHSA-jxqv-jcvh-7gr4

GHSA-jxqv-jcvh-7gr4

Atlantis Events vulnerable to Timing Attack

Source: GitHub Advisory Database (reviewed) High CVE-2022-24912

Packages

EcosystemPackageAffectedFixed in
Go github.com/runatlantis/atlantis < 0.19.7 0.19.7

Details

As written in the advisory (Markdown source, shown as plain text).

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.

References

External links from the advisory. They lead to third-party sites.