Advisories for Golang/Github.com/Openshift-Pipelines/Pipelines-as-Code package

When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This allows a user with push access to any repository in the installation to craft a PipelineRun with a remote task annotation pointing at a private repository in the same …

Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an installation.id, Pipelines-as-Code generated a GitHub App JWT and requested an installation access token before validating the webhook signature or checking that the Enterprise host matched the repository URL …