Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/buildkite/elastic-ci-stack-for-aws/v6 < 6.7.0
Fixed in
6.7.0· Vendor fix available
Issue
A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script.
Recommended action: Upgrade to 6.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/buildkite/elastic-ci-stack-for-aws/v6 < 6.7.1
Fixed in
6.7.1· Vendor fix available
Issue
A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script.
Recommended action: Upgrade to 6.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.