Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/netlify/gotrue

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedGoPublished

    User object created with invalid provider data in GoTrue

    GHSA-wpfr-6297-9v57

    Affected
    • Go github.com/netlify/gotrue < 1.0.1
    Fixed in
    1.0.1· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Under certain circumstances a valid user object would have been created with invalid provider metadata. This vulnerability affects everyone running an instance of GoTrue as a service. We advise you to update especially if you are using the provider metadata from the user object to secure other resources. Patches Has the problem been patched? What versions should users upgrade to? A patch is available with the release of version 1.0.1 on Github. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If you don't rely on the provider metadata in the user object, you might not be affected. We still strongly recommend upgrading. References Are there any links users can visit to find out more? This problem was initially found and reported by the team at Supabase: https://github.com/supabase/gotrue/security/advisories/GHSA-5hvv-9cqv-894r. We want to thank them for the cooperation around this…

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. UnratedGoPublished

    Auth bypass in SAML provider

    GHSA-433w-mm6h-rv9p

    Affected
    • Go github.com/netlify/gotrue < 1.0.0
    Fixed in
    1.0.0· Vendor fix available
    Issue
    Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider: - goxmldsig - Signature Validation Bypass - gosaml2 - Authentication Bypass Patches Patch available Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90 Workarounds No known workarounds. For more information If you have any questions or comments about this advisory: Open an issue in gotrue Email us at security@netlify.com

    Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →