Skip to content
Fencer Intel
high —

GHSA-28q9-9c3g-v3f9 json

lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

published 4y ago modified 8mo ago also GO-2022-1019

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.

### Patches

lakeFS v0.82.0 and later

### Workarounds

Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".

### References

[advisories/GHSA-28q9-9c3g-v3f9](https://github.com/treeverse/lakeFS/security/advisories/GHSA-28q9-9c3g-v3f9)

### For more information If you have any questions or comments about this advisory:

Ask on the [lakeFS Slack](https://github.com/treeverse/lakeFS/security/advisories/lakefs.io/slack) #help channel Email us at [security@treeverse.io](mailto:security@treeverse.io)

Patch / fix

  • go github.com/treeverse/lakefs 0.82.0

Is GHSA-28q9-9c3g-v3f9 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/treeverse/lakefs
<0.82.0
0.82.0

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions
  • CWE-284 Improper Access Control

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.