Description (CNA)
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| renovatebot / renovate | affected 0 before 44.61.3 |
| mend / renovate-ce | affected 0 before 15.5.0 |
| mend / renovate-ee-server | affected 0 before 15.5.0 |
| mend / renovate-ee-worker | affected 0 before 15.5.0 |
| mend / mend-renovate-ce helm chart | affected 0 before 15.5.0 |
| mend / mend-renovate-enterprise-edition helm chart | affected 0 before 10.5.0 |
CWE
CWE-693
References
- https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h
- https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request
ADP enrichment
No English description supplied.
No references supplied.