—
GO-2024-3051
Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Details
Meshery SQL Injection vulnerability in github.com/layer5io/meshery.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/layer5io/meshery before v0.7.22.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/layer5io/meshery
Introduced in:
0No fixed version published yet for github.com/layer5io/meshery (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/advisories/GHSA-h7cm-jvpp-69xf[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2024-35182[ADVISORY]
- https://securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery[ADVISORY]
- https://github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/events_streamer.go#L52[WEB]
- https://github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/models/events_persister.go#L47[WEB]
- https://github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c[WEB]
- https://github.com/meshery/meshery/pull/10280[WEB]