x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-hh33-46q4-hwm2

[GoVulnBot]

Advisory GHSA-hh33-46q4-hwm2 references a vulnerability in the following Go modules:

Module
github.com/treeverse/lakefs

Description:

Impact

Existing lakeFS users who have issued credentials to users who have been deleted.
Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

A possible workaround will be not to reuse usernames that were previously deleted

References

Are there any links users can visit to find out more?

References:

• ADVISORY: GHSA-hh33-46q4-hwm2
• ADVISORY: GHSA-hh33-46q4-hwm2

Cross references:

• github.com/treeverse/lakefs appears in 6 other report(s):
  • data/reports/GO-2022-0375.yaml (x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-m836-gxwq-j2pm #375)
  • data/reports/GO-2022-1019.yaml (x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-28q9-9c3g-v3f9 #1019)
  • data/reports/GO-2023-2012.yaml (x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-9phh-r37v-34wh #2012)
  • data/reports/GO-2023-2397.yaml (x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-26hr-q2wp-rvc5 #2397)
  • data/reports/GO-2023-2398.yaml (x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-4rgc-5g6r-2rjf #2398)
  • data/reports/GO-2024-2581.yaml (x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-fvv5-h29g-f6w5 #2581)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/treeverse/lakefs
      versions:
        - fixed: 1.33.0
      vulnerable_at: 1.32.1
summary: |-
    Re-creating a deleted user in lakeFS will re-enable previous user credentials
    that existed prior to its deletion in github.com/treeverse/lakefs
cves:
    - CVE-2024-43784
ghsas:
    - GHSA-hh33-46q4-hwm2
references:
    - advisory: https://github.com/advisories/GHSA-hh33-46q4-hwm2
    - advisory: https://github.com/treeverse/lakeFS/security/advisories/GHSA-hh33-46q4-hwm2
source:
    id: GHSA-hh33-46q4-hwm2
    created: 2024-11-26T20:01:24.628589051Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/632255 mentions this issue: data/reports: add 7 unreviewed reports