PT-2023-10355 · Unknown · Deis Workflow Manager

Published 2023-12-23 · Updated 2024-08-21 · CVE-2016-15036

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Deis Workflow Manager versions up to 2.3.2

Description A vulnerability was found in Deis Workflow Manager, which has been classified as problematic. This issue affects an unknown part of the system and leads to a race condition. The complexity of an attack is rather high, and the exploitability is told to be difficult.

Recommendations Upgrading to version 2.3.3 is able to address this issue. It is recommended to upgrade the affected component.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2016-15036

GHSA-JPFP-XQ3P-4H3R

GO-2023-2422

Affected Products

Deis Workflow Manager

References · 13

• https://github.com/deis/workflow-manager/releases/tag/v2.3.3 · Patch
• https://github.com/deis/workflow-manager/commit/31fe3bccbdde134a185752e53380330d16053f7f · Patch
• https://github.com/deis/workflow-manager/pull/94 · Patch
• https://osv.dev/vulnerability/CVE-2016-15036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15036 · Security Note
• https://osv.dev/vulnerability/GO-2023-2422 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jpfp-xq3p-4h3r · Vendor Advisory
• https://github.com/advisories/GHSA-jpfp-xq3p-4h3r · Note
• https://vuldb.com/?id.248847 · Note
• https://t.me/cvenotify/89344 · Telegram Post
• https://t.me/cvenotify/66115 · Telegram Post
• https://vuldb.com/?ctiid.248847 · Note
• https://t.me/cvenotify/65046 · Telegram Post