azure

Jun 18, 2024

Changes in this version

type Adapter

+ func (a *Adapter) BlockstoreMetadata(ctx context.Context) (*block.BlockstoreMetadata, error)

+ func (a *Adapter) GetRegion(_ context.Context, _ string) (string, error)

Apr 14, 2024

Changes in this version

+ const BlobEndpointChinaDomain

+ const BlobEndpointDefaultDomain

+ const BlobEndpointTestDomain

+ const BlobEndpointUSGovDomain

+ var ErrInvalidDomain = errors.New("invalid Azure Domain")

+ func ParseURL(uri *url.URL) (accountName string, domain string, err error)

type Adapter

+ func (a *Adapter) ListParts(_ context.Context, _ block.ObjectPointer, _ string, _ block.ListPartsOpts) (*block.ListPartsResponse, error)

Mar 12, 2024

Changes in this version

+ const BlobEndpointChinaCloudFormat

+ const BlobEndpointGlobalFormat

type BlobURLInfo

+ Host string

Feb 20, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 19, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 14, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 5, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 22, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 21, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 15, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 8, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

type Adapter

+ func (a *Adapter) GetPresignUploadPartURL(ctx context.Context, obj block.ObjectPointer, uploadID string, partNumber int) (string, error)

Jan 4, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 3, 2024 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Dec 24, 2023 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Dec 10, 2023 GO-2024-2581

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Nov 30, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Nov 13, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 25, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 19, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ const DirectoryBlobMetadataKey

Oct 15, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 8, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 8, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 4, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 3, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Oct 1, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ const UDCCacheExpiry

+ const UDCCacheWorkaroundDivider

Sep 14, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ const BlobEndpointFormat

Sep 10, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 29, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 24, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 20, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 16, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 15, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 14, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 8, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 18, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 9, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 4, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 1, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 1, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 21, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 21, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 10, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 24, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 19, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 5, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

type BlobWalker

+ func (a *BlobWalker) GetSkippedEntries() []block.ObjectStoreEntry

type DataLakeWalker

+ func (a *DataLakeWalker) GetSkippedEntries() []block.ObjectStoreEntry

Mar 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 28, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 28, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ type DataLakeWalker struct

+ func NewAzureDataLakeWalker(svc *service.Client) (*DataLakeWalker, error)

+ func (a *DataLakeWalker) Marker() block.Mark

+ func (a *DataLakeWalker) Walk(ctx context.Context, storageURI *url.URL, op block.WalkOptions, ...) error

Mar 26, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ var ErrAzureInvalidURL = errors.New("invalid Azure storage URL")

type Adapter

+ func (a *Adapter) GetWalker(uri *url.URL) (block.Walker, error)

+ func (a *Adapter) ResolveNamespace(storageNamespace, key string, identifierType block.IdentifierType) (block.QualifiedKey, error)

+ type BlobWalker struct

+ func NewAzureBlobWalker(svc *service.Client) (*BlobWalker, error)

+ func (a *BlobWalker) Marker() block.Mark

+ func (a *BlobWalker) Walk(ctx context.Context, storageURI *url.URL, op block.WalkOptions, ...) error

Mar 9, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 9, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 6, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 26, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 23, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 8, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 7, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 2, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ type ClientCache struct

+ func (c *ClientCache) NewContainerClient(storageAccount, containerName string) (*container.Client, error)

+ func (c *ClientCache) NewServiceClient(storageAccount string) (*service.Client, error)

+ func (c *ClientCache) NewUDC(ctx context.Context, storageAccount string, expiry *time.Time) (*service.UserDelegationCredential, error)

Jan 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ func BuildAzureServiceClient(params params.Azure) (*service.Client, error)

+ func ExtractStorageAccount(storageAccount *url.URL) (string, error)

type BlobURLInfo

+ StorageAccountName string

+ type ClientContainerCache struct

+ func NewCache(p params.Azure) *ClientContainerCache

+ func (c *ClientContainerCache) NewContainerClient(storageAccount, containerName string) (*container.Client, error)

type PrefixURLInfo

+ StorageAccountName string

Jan 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 17, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Changes in this version

+ const URLTemplate

type Adapter

+ func (a *Adapter) GetPreSignedURL(_ context.Context, obj block.ObjectPointer, mode block.PreSignMode) (string, error)

type BlobURLInfo

+ ContainerName string

+ func ResolveBlobURLInfoFromURL(pathURL *url.URL) (BlobURLInfo, error)

type MultipartBlockWriter

+ func (m *MultipartBlockWriter) Upload(_ context.Context, _ io.ReadSeekCloser, _ *blockblob.UploadOptions) (blockblob.UploadResponse, error)

type PrefixURLInfo

+ ContainerName string

Jan 8, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 22, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 14, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 13, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 24, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 16, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 8, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 24, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 12, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 4, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 3, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 22, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 9, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 5, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 4, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 30, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 23, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 23, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 22, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 17, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 11, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 3, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 14, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 11, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jun 21, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jun 15, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

May 25, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

May 17, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Apr 29, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Apr 17, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Apr 3, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Mar 7, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Feb 28, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Feb 27, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Feb 15, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Feb 8, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jan 26, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 26, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 20, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 16, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 5, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 17, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 8, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 27, 2021 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 25, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 10, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 4, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 4, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 14, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 5, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 2, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 2, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 22, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 28, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 19, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 19, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 7, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 7, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 1, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jun 24, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jun 8, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

May 30, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type Adapter

+ func (a *Adapter) RuntimeStats() map[string]string

May 12, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

May 3, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Apr 25, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Apr 20, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Apr 20, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ var ErrAsyncCopy = errors.New("asynchronous copy not supported")

Mar 17, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const AuthMethodAccessKey

+ const AuthMethodMSI

+ const BlockstoreType

+ const MaxBuffers

+ var ErrEmptyBuffer = errors.New("TransferManager returned a 0 size buffer, this is a bug in the manager")

+ var ErrNotImplemented = errors.New("not implemented")

+ func CompleteMultipart(ctx context.Context, parts []*s3.CompletedPart, container azblob.ContainerURL, ...) (*string, int64, error)

+ func GetAccessKeyCredentials(accountName, accountKey string) (azblob.Credential, error)

+ func GetMSICredentials() (azblob.Credential, error)

+ type Adapter struct

+ func NewAdapter(pipeline pipeline.Pipeline, opts ...func(a *Adapter)) *Adapter

+ func (a *Adapter) AbortMultiPartUpload(ctx context.Context, _ block.ObjectPointer, _ string) error

+ func (a *Adapter) BlockstoreType() string

+ func (a *Adapter) CompleteMultiPartUpload(ctx context.Context, obj block.ObjectPointer, _ string, ...) (*string, int64, error)

+ func (a *Adapter) Copy(ctx context.Context, sourceObj, destinationObj block.ObjectPointer) error

+ func (a *Adapter) CreateMultiPartUpload(ctx context.Context, obj block.ObjectPointer, _ *http.Request, ...) (string, error)

+ func (a *Adapter) Download(ctx context.Context, obj block.ObjectPointer, offset, count int64) (io.ReadCloser, error)

+ func (a *Adapter) Exists(ctx context.Context, obj block.ObjectPointer) (bool, error)

+ func (a *Adapter) GenerateInventory(_ context.Context, _ logging.Logger, _ string, _ bool, _ []string) (block.Inventory, error)

+ func (a *Adapter) Get(ctx context.Context, obj block.ObjectPointer, _ int64) (io.ReadCloser, error)

+ func (a *Adapter) GetProperties(ctx context.Context, obj block.ObjectPointer) (block.Properties, error)

+ func (a *Adapter) GetRange(ctx context.Context, obj block.ObjectPointer, startPosition int64, ...) (io.ReadCloser, error)

+ func (a *Adapter) GetStorageNamespaceInfo() block.StorageNamespaceInfo

+ func (a *Adapter) Put(ctx context.Context, obj block.ObjectPointer, sizeBytes int64, ...) error

+ func (a *Adapter) Remove(ctx context.Context, obj block.ObjectPointer) error

+ func (a *Adapter) UploadCopyPart(ctx context.Context, sourceObj, destinationObj block.ObjectPointer, _ string, ...) (string, error)

+ func (a *Adapter) UploadCopyPartRange(ctx context.Context, sourceObj, destinationObj block.ObjectPointer, _ string, ...) (string, error)

+ func (a *Adapter) UploadPart(ctx context.Context, obj block.ObjectPointer, _ int64, reader io.Reader, ...) (string, error)

+ func (a *Adapter) ValidateConfiguration(ctx context.Context, _ string) error

+ func (a *Adapter) Walk(ctx context.Context, walkOpt block.WalkOpts, walkFn block.WalkFunc) error

+ type BlobURLInfo struct

+ BlobURL string

+ ContainerURL string

+ type MultipartBlockWriter struct

+ func NewMultipartBlockWriter(reader *block.HashingReader, containerURL azblob.ContainerURL, objName string) *MultipartBlockWriter

+ func (m *MultipartBlockWriter) CommitBlockList(ctx context.Context, ids []string, headers azblob.BlobHTTPHeaders, ...) (*azblob.BlockBlobCommitBlockListResponse, error)

+ func (m *MultipartBlockWriter) StageBlock(ctx context.Context, s string, seeker io.ReadSeeker, ...) (*azblob.BlockBlobStageBlockResponse, error)

+ type PrefixURLInfo struct

+ ContainerURL string

+ Prefix string

Mar 29, 2022 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jan 25, 2022 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jan 25, 2022 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jan 25, 2022 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 26, 2021 GO-2022-0375 +4 more

  GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs