QwikSec

Security Database

CVE

CWE

Training

CVE-2021-21432

Published: Apr 9, 2021

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

Vendor	Product	Versions
go-vela	server	affected `>= 0.7.0, < 0.7.5`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

References

https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4

x_refsource_CONFIRM

https://pkg.go.dev/github.com/go-vela/server

x_refsource_MISC

https://github.com/go-vela/server/releases/tag/v0.7.5

x_refsource_MISC

https://github.com/go-vela/server/pull/337

x_refsource_MISC

https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.