Most recent entries from all

bdu:2024-02146

EUVD-2026-230783

fkie_cve-2024-28110

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.

GHSA-5pf6-2qwx-pxm2 — Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Affected: Go: github.com/cloudevents/sdk-go/v2

### Impact _What kind of vulnerability is it? Who is impacted?_ Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints.

The relevant code is [here](https://github.com/cloudevents/sdk-go/blob/67e389964131d55d65cd14b4eb32d57a47312695/v2/protocol/http/protocol.go#L104-L110) (also inline, emphasis added):

<pre>if p.Client == nil { p.Client = **http.DefaultClient** }

if p.roundTripper != nil { p.Client.**Transport = p.roundTripper** } </pre>

When the transport is populated with an authenticated transport such as: - [oauth2.Transport](https://pkg.go.dev/golang.org/x/oauth2#Transport) - [idtoken.NewClient(...).Transport](https://pkg.go.dev/google.golang.org/api/idtoken#NewClient)

... then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to **any endpoint** it is used to contact!

Found and patched by: @tcnghia and @mattmoor

### Patches v.2.15.2

gsd-2024-28110

msrc_CVE-2024-28110 — Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

msrc_CVE-2024-28110

RHEA-2024:4022 — Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.15.0 release

golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials jose-go: improper handling of highly compressed data cosign: Malicious attachments can cause system-wide denial of service cosign: Malicious artifects can cause machine-wide denial of service

WID-SEC-W-2024-0637 — Red Hat OpenShift Serverless: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Serverless ausnutzen, um Informationen offenzulegen.