CVE-2021-21432

2021-04-0918:15:13

Google

osv.dev

vela

pipeline automation

linux container technology

golang

authentication mechanism

malicious user

secrets

~/.netrc file

github security advisory

fixed

version 0.7.5

software

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

41.0%

JSON

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the ~/.netrc file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.