—
GO-2023-2014
Woodpecker does not validate webhook before changing any data in github.com/woodpecker-ci/woodpecker
Quick fix
GO-2023-2014 — github.com/woodpecker-ci/woodpecker: upgrade to the fixed version with the command below.
go get github.com/woodpecker-ci/woodpecker@v1.0.2Details
Woodpecker does not validate webhook before changing any data in github.com/woodpecker-ci/woodpecker
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/woodpecker-ci/woodpecker
Introduced in:
1.0.0Fixed in: 1.0.2Fix
go get github.com/woodpecker-ci/woodpecker@v1.0.2References
- https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2023-40034[ADVISORY]
- https://github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105[FIX]
- https://github.com/woodpecker-ci/woodpecker/pull/2221[FIX]
- https://github.com/woodpecker-ci/woodpecker/pull/2222[FIX]
- https://github.com/woodpecker-ci/woodpecker/releases/tag/v1.0.2[WEB]