PT-2024-30654 · Lakefs · Lakefs

N-O-Z · Published 2024-11-26 · Updated 2024-12-11 · CVE-2024-43784

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.33.0

Description lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this issue. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user's credentials.

Recommendations For versions prior to 1.33.0, upgrade to release version 1.33.0 to address the issue. As a temporary workaround for those who cannot upgrade, do not reuse usernames that were previously deleted.

Exploit

Fix

Improper Authentication

Improper Preservation of Permissions

Weakness Enumeration

CWE-287

CWE-281

Related Identifiers

CVE-2024-43784

GHSA-HH33-46Q4-HWM2

GO-2024-3291

OPENSUSE-SU-2024:14567-1

Affected Products

Lakefs

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43784.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-43784 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hh33-46q4-hwm2 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43784 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14567-1 · Vendor Advisory
• https://github.com/treeverse/lakeFS · Note
• https://github.com/treeverse/lakeFS/releases/tag/v1.33.0 · Note
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-hh33-46q4-hwm2 · Note
• https://t.me/cvenotify/102623 · Telegram Post
• https://suse.com/security/cve/CVE-2024-53264 · Note
• https://suse.com/security/cve/CVE-2024-53858 · Note
• https://suse.com/security/cve/CVE-2024-54132 · Note
• https://suse.com/security/cve/CVE-2024-50948 · Note
• https://suse.com/security/cve/CVE-2024-52529 · Note