MEDIUM5.3
GO-2026-6619
Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer
Quick fix
GO-2026-6619 — github.com/portainer/portainer: upgrade to the fixed version with the command below.
go get github.com/portainer/portainer@v0.6.1-0.20240417040827-48bc7d0d92f0Details
Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/portainer/portainer
Introduced in:
0Fixed in: 0.6.1-0.20240417040827-48bc7d0d92f0Fix
go get github.com/portainer/portainer@v0.6.1-0.20240417040827-48bc7d0d92f0References
- https://github.com/advisories/GHSA-87x6-8m9v-g8c2[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2024-29296[ADVISORY]
- https://github.com/portainer/portainer/commit/48bc7d0d92f038e04a72c1e0585bc325eb63a9e6[FIX]
- https://github.com/portainer/portainer/pull/11589[FIX]
- https://github.com/portainer/portainer/issues/11736[REPORT]
- https://github.com/ThaySolis/CVE-2024-29296[WEB]
- https://github.com/portainer/portainer/releases/tag/2.19.5[WEB]
- https://github.com/portainer/portainer/releases/tag/2.20.2[WEB]