Affected by GO-2024-2582 and 4 other vulnerabilities

GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

pkg/

Details

Path	Synopsis
api
protobuf/go/minder/v1 Package v1 is a reverse proxy.	Package v1 is a reverse proxy.
mindpak Package mindpak abstracts to bundle profiles and rule types together in an artifact that allows for easy distribution and upgrade.	Package mindpak abstracts to bundle profiles and rule types together in an artifact that allows for easy distribution and upgrade.
build Package build implements tools and function to build mindpaks.	Package build implements tools and function to build mindpaks.
providers
v1 Package v1 for providers provides the public interfaces for the providers implemented by minder.	Package v1 for providers provides the public interfaces for the providers implemented by minder.
rule_methods Package rule_methods provides the methods that are used by the rules	Package rule_methods provides the methods that are used by the rules