RCE in Go-Vela Compiler
CVE-2020-26294
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.018 (77.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Go-Vela Compiler — versions < 0.6.1
- Target Compiler
Weakness classification (CWE)
References
- github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68j (Exploit, Third Party Advisory)
- github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bda (Patch, Third Party Advisory)
- pkg.go.dev/github.com/go-vela/compiler/compiler (Product, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-26294?
- CVE-2020-26294 is a high-severity vulnerability in Go-Vela Compiler, classified under OS Command Injection. CVSS score: 7.4/10. Published 2021-01-04.
- How severe is CVE-2020-26294?
- High severity. CVSS v3 base score is 7.4 out of 10.