GO-2024-3306
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-53257
- Alias
- GHSA-7mwh-q3xm-qh6p
Description
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · vitess.io/vitess | introduced 0, fixed 0.19.8, introduced 0.20.0, fixed 0.20.4, introduced 0.21.0, fixed 0.21.1 |
Références
- https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p ADVISORY
- https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |