params

Aug 20, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 16, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 15, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 14, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 8, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 18, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 9, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

type Config

+ CosmosDB *CosmosDB

+ type CosmosDB struct

+ Client *http.Client

+ Container string

+ Database string

+ Endpoint string

+ Key string

+ StrongConsistency bool

Jun 4, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 1, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 1, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 21, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 21, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 10, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 24, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 19, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 5, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 28, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 28, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 26, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 9, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 9, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 6, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 26, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 23, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

type DynamoDB

+ HealthCheckInterval time.Duration

Feb 8, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 7, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 2, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 17, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 8, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ type Config struct

+ DynamoDB *DynamoDB

+ Local *Local

+ Postgres *Postgres

+ Type string

Dec 22, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 14, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 13, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 24, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 16, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 8, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 24, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 12, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 4, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 3, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 22, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type DynamoDB

+ AwsProfile string

type KV

+ Local *Local

+ type Local struct

+ EnableLogging bool

+ Path string

+ PrefetchSize int

+ SyncWrites bool

type Postgres

+ Metrics bool

Oct 9, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 5, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 4, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 30, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 23, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 23, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 22, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type Postgres

+ ScanPageSize int32

Aug 17, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type Postgres

+ ConnectionMaxLifetime time.Duration

+ MaxIdleConnections int32

+ MaxOpenConnections int32

Aug 11, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type KV

+ Type string

Aug 3, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 14, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 11, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ type DynamoDB struct

+ AwsAccessKeyID string

+ AwsRegion string

+ AwsSecretAccessKey string

+ Endpoint string

+ ReadCapacityUnits int64

+ ScanLimit int64

+ TableName string

+ WriteCapacityUnits int64

+ type KV struct

+ DynamoDB *DynamoDB

+ Postgres *Postgres

+ type Postgres struct

+ ConnectionString string