Vulnerability Database

309,961

Total vulnerabilities in the database

CVE-2021-21432

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the ~/.netrc file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
go-vela / vela - 0.7.5
Go icon github.com/go-vela/server 0.7.0 0.7.5
Go icon github.com/go-vela/server/api 0.7.0 0.7.5