x/vulndb: potential Go vuln in github.com/stacklok/minder: CVE-2024-35194

[GoVulnBot]

CVE-2024-35194 references github.com/stacklok/minder, which may be a Go module.

Description:
Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-35194
• JSON: https://github.com/CVEProject/cvelist/tree/7477d656f42f3019a869d55d2f9dc8483c120d41/2024/35xxx/CVE-2024-35194.json
• advisory: GHSA-crgc-2583-rw27
• fix: mindersec/minder@fe321d3
• Imported by: https://pkg.go.dev/github.com/stacklok/minder?tab=importedby

Cross references:

• Module github.com/stacklok/minder appears in issue x/vulndb: potential Go vuln in github.com/stacklok/minder: CVE-2024-27093 #2582 NOT_IMPORTABLE
• Module github.com/stacklok/minder appears in issue x/vulndb: potential Go vuln in github.com/stacklok/minder: GHSA-v627-69v2-xx37 #2608
• Module github.com/stacklok/minder appears in issue x/vulndb: potential Go vuln in github.com/stacklok/minder: GHSA-9c5w-9q3f-3hv7 #2821

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/stacklok/minder
      vulnerable_at: 0.0.50
      packages:
        - package: minder
summary: CVE-2024-35194 in github.com/stacklok/minder
cves:
    - CVE-2024-35194
references:
    - advisory: https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27
    - fix: https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892
source:
    id: CVE-2024-35194
    created: 2024-05-20T22:01:41.631827221Z

[gopherbot]

Change https://go.dev/cl/590277 mentions this issue: data/reports: add 26 unreviewed reports