—
GO-2024-2581
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
Quick fix
GO-2024-2581 — github.com/treeverse/lakefs: upgrade to the fixed version with the command below.
go get github.com/treeverse/lakefs@v1.12.1Details
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/treeverse/lakefs
Introduced in:
0.90.0Fixed in: 1.12.1Fix
go get github.com/treeverse/lakefs@v1.12.1