Vulnerability Report: GO-2022-0534

• CVE-2022-24912, GHSA-jxqv-jcvh-7gr4
• Affects: github.com/runatlantis/atlantis
• Published: Aug 11, 2022
• Modified: May 20, 2024

Validation of Gitlab requests can leak secrets. The package github.com/runatlantis/atlantis/server/controllers/events uses a non-constant time comparison for secrets while validating a Gitlab request. This allows for a timing attack where an attacker can recover a secret and then forge the request.