CVE-2023-42798

Summary

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECT_PATH_RELEASE (e.g. releases/) directory is manually and actually git cloned properly, making it a different git repostiory from the root git repository.

Affected Software

Weaknesses

• CWE-20: CWE-20: Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/ChewKeanHo/AutomataCI/security/advisories/GHSA-6q23-vhhg-8h89
• https://github.com/ChewKeanHo/AutomataCI/issues/93

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/ChewKeanHo/AutomataCI/security/advisories/GHSA-6q23-vhhg-8h89
• https://github.com/ChewKeanHo/AutomataCI/issues/93

• ←Previous
• Next→