Invalid Provider Data Vulnerability in GoTrue
Summary
GHSA-wpfr-6297-9v57: User object created with invalid provider data in GoTrue. Affects github.com/netlify/gotrue versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoTrue is an open-source authentication and user management library for Go applications. It provides features like user registration, login, and password recovery. The vulnerability affects instances of GoTrue used as a service. The provider metadata in the user object can be created with invalid data under certain circumstances.
Vulnerability Detail
The vulnerability allows the creation of a valid user object with incorrect provider metadata. This can impact users who rely on the provider metadata for securing other resources. The severity of this vulnerability is considered moderate. The issue has been patched in version 1.0.1 of GoTrue. Users are advised to upgrade to this version to mitigate the vulnerability.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
go get github.com/netlify/gotrue@v1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If users do not rely on the provider metadata in the user object, they may not be affected by this vulnerability. However, it is still recommended to upgrade to the patched version of GoTrue.
Conclusion
The invalid provider data vulnerability in GoTrue can lead to the creation of user objects with incorrect provider metadata. Users are advised to upgrade to version 1.0.1 or later to fix the vulnerability. If users do not rely on the provider metadata, they may not be affected, but upgrading is still recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/netlify/gotrue →
FAQ
This vulnerability affects everyone running an instance of GoTrue as a service.
Under certain circumstances, a valid user object can be created with invalid provider metadata. This can impact users who rely on the provider metadata for securing other resources.
Yes, the vulnerability has been patched in version 1.0.1 of GoTrue.
If users do not rely on the provider metadata in the user object, they may not be affected by this vulnerability. However, it is still recommended to upgrade to the patched version of GoTrue.
More information about this vulnerability can be found in the advisory report by Supabase: https://github.com/supabase/gotrue/security/advisories/GHSA-5hvv-9cqv-894r
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/netlify/gotrue.
