Vulnerability Description
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ghinstallation Project | Ghinstallation | < 2.0.0 |
Related Weaknesses (CWE)
References
- https://docs.github.com/en/developers/apps/building-github-apps/authenticating-wTechnical DescriptionThird Party Advisory
- https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff7ExploitThird Party Advisory
- https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026ePatchThird Party Advisory
- https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96PatchThird Party Advisory
- https://docs.github.com/en/developers/apps/building-github-apps/authenticating-wTechnical DescriptionThird Party Advisory
- https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff7ExploitThird Party Advisory
- https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026ePatchThird Party Advisory
- https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96PatchThird Party Advisory
FAQ
What is CVE-2022-39304?
CVE-2022-39304 is a vulnerability with a CVSS score of 5.0 (MEDIUM). ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installa...
How severe is CVE-2022-39304?
CVE-2022-39304 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-39304?
Check the references section above for vendor advisories and patch information. Affected products include: Ghinstallation Project Ghinstallation.