CVE-2021-21432
High
Description
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.
SeverityHigh
CVSS7.5
Exploit probability—
ProductVela
PublishedApr 9, 2021
First seenApr 9, 2021
Weakness typeCWE-285CWE-285
How to fix
Update
- go-vela vela0.7.5 or later
- github.com/go-vela/server0.7.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| go-vela vela | v < 0.7.5 | 0.7.5 |
| github.com/go-vela/serverGo | 0.7.0 ≤ v < 0.7.5 | 0.7.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.