id: GO-2022-0534
modules:
    - module: github.com/runatlantis/atlantis
      versions:
        - fixed: 0.19.7
      vulnerable_at: 0.19.6
      packages:
        - package: github.com/runatlantis/atlantis/server/controllers/events
          symbols:
            - DefaultGitlabRequestParserValidator.ParseAndValidate
summary: Timing attack in github.com/runatlantis/atlantis
description: |-
    Validation of Gitlab requests can leak secrets.

    The package github.com/runatlantis/atlantis/server/controllers/events uses a
    non-constant time comparison for secrets while validating a Gitlab request. This
    allows for a timing attack where an attacker can recover a secret and then forge
    the request.
published: 2022-08-11T20:54:51Z
cves:
    - CVE-2022-24912
ghsas:
    - GHSA-jxqv-jcvh-7gr4
credits:
    - cedws
references:
    - fix: https://github.com/runatlantis/atlantis/pull/2392
    - fix: https://github.com/runatlantis/atlantis/commit/48870911974adddaa4c99c8089e79b7d787fa820
    - web: https://github.com/runatlantis/atlantis/issues/2391
    - web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUNATLANTISATLANTISSERVERCONTROLLERSEVENTS-2950851