Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. Patches https://github.com/woodpecker-ci/woodpecker/pull/3933 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Enable the "gated" repo feature and review each change upfront References - https://github.com/woodpecker-ci/woodpecker/pull/3933 - https://github.com/woodpecker-ci/woodpecker-security/pull/11 - https://github.com/woodpecker-ci/woodpecker-security/issues/8 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924) - https://github.com/woodpecker-ci/woodpecker-security/issues/9 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924) -…
Recommended action: Upgrade to 2.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. Patches https://github.com/woodpecker-ci/woodpecker/pull/3909 https://github.com/woodpecker-ci/woodpecker/pull/3934 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Enable the "gated" repo feature and review each change upfront of running References - https://github.com/woodpecker-ci/woodpecker/pull/3909 - https://github.com/woodpecker-ci/woodpecker/pull/3934 - https://github.com/woodpecker-ci/woodpecker-security/issues/10 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3929) - https://github.com/woodpecker-ci/woodpecker/issues/3929 (info will be published later once we got adoption of the update)…
Recommended action: Upgrade to 2.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.