GHSA-vfxf-76hv-v4w4: Withdrawn Advisory User-provided Environment Values Allow Execution Vulnerability
HIGHGHSA-vfxf-76hv-v4w4 is a HIGH user-provided environment values allow execution vulnerability (General Security Weakness) affecting Withdrawn Advisory libraries in the Go ecosystem. The issue involves user-provided environment values allow execution on macos agents. Remediation is available by upgrading affected packages to version 14.2.4, 13.4.13, 12.4.31.
GHSA-vfxf-76hv-v4w4 at a Glance
How to Fix GHSA-vfxf-76hv-v4w4
To remediate this vulnerability, upgrade all affected Withdrawn Advisory dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/gravitational/teleport to 14.2.4Upgrade github.com/gravitational/teleport to 13.4.13Upgrade github.com/gravitational/teleport to 12.4.31Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/gravitational/teleportHow to Check if You Are Affected
To determine whether your application is affected by GHSA-vfxf-76hv-v4w4, inspect your project dependencies for Withdrawn Advisory:
inspect dependencies for github.com/gravitational/teleportAnalyze the terminal output to locate any version of Withdrawn Advisory in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 14.2.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Withdrawn Advisory, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-vfxf-76hv-v4w4 Affected Withdrawn Advisory Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/gravitational/teleport
|
Go |
≥ 14.0.0
< 14.2.4
|
14.2.4
|
|
github.com/gravitational/teleport
|
Go |
≥ 13.0.0
< 13.4.13
|
13.4.13
|
|
github.com/gravitational/teleport
|
Go |
< 12.4.31
|
12.4.31
|
References
Frequently Asked Questions
What is GHSA-vfxf-76hv-v4w4?
Which Withdrawn Advisory versions are affected?
What version fixes GHSA-vfxf-76hv-v4w4?
Is github.com/gravitational/teleport affected?
What CWE is associated with GHSA-vfxf-76hv-v4w4?
How can I check Go dependencies for GHSA-vfxf-76hv-v4w4?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-vfxf-76hv-v4w4",
"modified" : "2024-09-06T21:40:14Z",
"published" : "2024-01-03T21:30:17Z",
"withdrawn" : "2024-01-23T12:49:53Z",
"aliases" : [ ],
"summary" : "Withdrawn Advisory: User-provided environment values allow execution on macOS agents",
"details" : "## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability affects a binary, not a library in a [supported ecosystem](https://github.com/github/advisory-database#supported-ecosystems). Therefore, users of the library should not receive alerts. This link is maintained to preserve external references.\n\n## Original Description\n\n### Impact\nAgents running on macOS could be susceptible to unexpected code execution through user supplied environment variables.\n\n### Patches\nFixed in versions 14.2.4, 13.4.13 and 12.4.31.\n\n### References\n* Fix PR: https://github.com/gravitational/teleport/pull/36132\n",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/gravitational/teleport"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "14.0.0"
}, {
"fixed" : "14.2.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/gravitational/teleport"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "13.0.0"
}, {
"fixed" : "13.4.13"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/gravitational/teleport"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "12.4.31"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/gravitational/teleport/security/advisories/GHSA-vfxf-76hv-v4w4"
}, {
"type" : "WEB",
"url" : "https://github.com/gravitational/teleport/pull/36132"
}, {
"type" : "WEB",
"url" : "https://github.com/gravitational/teleport/commit/fcc97de9f99dfec8696ecfd620672a26f29cf9ac"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/gravitational/teleport"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-01-03T21:30:17Z",
"nvd_published_at" : null
}
}