CVE-2024-35185: Denial of service of Minder Server with attacker-controlled REST endpoint

May 16, 2024

The Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server.

References

github.com/advisories/GHSA-fjw8-3gp8-4cvx
github.com/stacklok/minder
github.com/stacklok/minder/commit/065049336aac0621ee00a0bb2211f8051d47c14b
github.com/stacklok/minder/security/advisories/GHSA-fjw8-3gp8-4cvx
nvd.nist.gov/vuln/detail/CVE-2024-35185

Code Behaviors & Features

Detect and mitigate CVE-2024-35185 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →