Description
Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94e7`.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| stacklok | minder | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-1208 | Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94e7`. |
 Github GHSA |
GHSA-ggp5-28x4-xcj9 | Minder GetRepositoryByName data leak |
References
History
No history.
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-02T01:52:56.973Z
Reserved: 2024-04-03T17:55:32.646Z
Link: CVE-2024-31455
Vulnrichment
Updated: 2024-07-05T12:48:46.822Z
NVD
Status : Awaiting Analysis
Published: 2024-04-09T17:16:03.043
Modified: 2024-11-21T09:13:33.317
Link: CVE-2024-31455
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses