Vulnerability advisory
GO-2022-0534
Timing attack in github.com/runatlantis/atlantis
Also known as CVE-2022-24912GHSA-jxqv-jcvh-7gr4
Severity
Severity not reported.
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 0.19.7 | 0.19.7 |
Description
Validation of Gitlab requests can leak secrets.
The package github.com/runatlantis/atlantis/server/controllers/events uses a non-constant time comparison for secrets while validating a Gitlab request. This allows for a timing attack where an attacker can recover a secret and then forge the request.