Description
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
go-vela server
>= 0.7.0, < 0.7.5affected
References
- https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4 ↗
- https://pkg.go.dev/github.com/go-vela/server ↗
- https://github.com/go-vela/server/releases/tag/v0.7.5 ↗
- https://github.com/go-vela/server/pull/337 ↗
- https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46 ↗