Affected by GO-2024-2582 and 4 other vulnerabilities

GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

pkg/

Details

Path	Synopsis
api
protobuf/go/minder/v1 Package v1 is a reverse proxy.	Package v1 is a reverse proxy.
providers
v1 Package v1 for providers provides the public interfaces for the providers implemented by minder.	Package v1 for providers provides the public interfaces for the providers implemented by minder.
rule_methods Package rule_methods provides the methods that are used by the rules	Package rule_methods provides the methods that are used by the rules