CVE-2019-3792: SQL Injection in github.com/concourse/concourse/atc/db
Summary
CVE-2019-3792: Pivotal Concourse SQL Injection Vulnerability. Affects github.com/concourse/concourse versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/concourse/concourse/atc/db is a part of Pivotal Concourse version 5.0.0. It provides an API that allows Concourse resources to interact with the Concourse server. This package is written in Go and is vulnerable to SQL injection attacks. An attacker can exploit this vulnerability by crafting a version identifier that carries a SQL injection payload to the Concourse server. This allows the attacker to read privileged data from the server.
Vulnerability Detail
The SQL injection vulnerability in Pivotal Concourse version 5.0.0 allows an attacker to execute arbitrary SQL queries on the Concourse server. By manipulating the version identifier, the attacker can inject malicious SQL code that can bypass input validation and access sensitive data. This can lead to unauthorized access, data leakage, and potential compromise of the Concourse server. The vulnerability has a CVSS score of 5.6, indicating a moderate severity.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
go get github.com/concourse/concourse@v5.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is strongly advised to upgrade to the fixed version as soon as possible to mitigate the risk of SQL injection attacks.
Conclusion
In conclusion, the package github.com/concourse/concourse/atc/db in Pivotal Concourse version 5.0.0 is vulnerable to SQL injection. This vulnerability can be exploited by crafting a malicious version identifier, allowing an attacker to execute arbitrary SQL queries and access privileged data. It is crucial to upgrade to the fixed version (5.0.1) to protect the Concourse server from potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/concourse/concourse →
FAQ
The vulnerability allows an attacker to execute arbitrary SQL queries on the Concourse server, potentially leading to unauthorized access and data leakage.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
Yes, the CVSS score for this vulnerability is 5.6, indicating a moderate severity.
There are no known exploits for this vulnerability at the moment. However, it is still important to patch the vulnerability to prevent any potential attacks.
The recommended course of action is to upgrade to the fixed version of Pivotal Concourse (5.0.1) to mitigate the risk of SQL injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/concourse/concourse.
