otterdogのwebappに認証不要のコード実行脆弱性、修正版あり
Summary
Eclipse Foundationのotterdogのwebappで、GITHUB_WEBHOOK_SECRET未設定だと認証なしにコードを実行される脆弱性が公表されました。webappを動かしているなら、この値の設定有無を確認し、修正版への更新も進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Eclipse Foundationのotterdogのwebappで、GITHUB_WEBHOOK_SECRET未設定だと認証なしにコードを実行される脆弱性が公表されました。webappを動かしているなら、この値の設定有無を確認し、修正版への更新も進めてください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Eclipse Foundationotterdog |
≥ 0.9.0, < 1.3.2→ 1.3.2 |
1.3.2 |
Original description The description as published by the source.
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web gitlab.eclipse.org
- web pypi.org