Affected by GO-2022-0375 and 7 other vulnerabilities

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

GO-2024-3291: Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

GO-2025-3479: lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs

GO-2025-4090: lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs

params

package

v0.18.0 Latest Latest Go to latest Published: Dec 2, 2020 License: Apache-2.0 Imports: 1 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/treeverse/lakefs

Links

Open Source Insights

Documentation ¶

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type GS ¶

type GS struct {
	CredentialsFile string
	CredentialsJSON string
}

type Local ¶

type Local struct {
	Path string
}

type Mem ¶

type Mem struct{}

type S3 ¶

type S3 struct {
	AwsConfig             *aws.Config
	StreamingChunkSize    int
	StreamingChunkTimeout time.Duration
}

Source Files ¶

View all Source files

block.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL