x/vulndb: potential Go vuln in github.com/stacklok/minder: CVE-2024-27093

[GoVulnBot]

CVE-2024-27093 references github.com/stacklok/minder, which may be a Go module.

Description:
Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database). When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result. Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully. Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability. This vulnerability is patched in version 0.20240226.1425+ref.53868a8.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-27093
• JSON: https://github.com/CVEProject/cvelist/tree/007b32c821a01fdf926ae4149aa08405a168c5e3/2024/27xxx/CVE-2024-27093.json
• advisory: GHSA-q6h8-4j2v-pjg4
• fix: mindersec/minder@53868a8
• Imported by: https://pkg.go.dev/github.com/stacklok/minder?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/stacklok/minder
      vulnerable_at: 0.0.31
      packages:
        - package: minder
cves:
    - CVE-2024-27093
references:
    - advisory: https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4
    - fix: https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d

[jba]

Vuln in an internal package imported only by a binary.

[gopherbot]

Change https://go.dev/cl/567817 mentions this issue: data/excluded: batch add 15 excluded reports

[gopherbot]

Change https://go.dev/cl/569597 mentions this issue: data/reports: add GO-2024-2582.yaml

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports

[gopherbot]

Change https://go.dev/cl/606358 mentions this issue: data/reports: regenerate 50 reports