Skip to content

JSON payload deserialized before signature check

Low
gsmet published GHSA-h75f-8cx6-pmfp Jun 6, 2023

Package

maven io.quarkiverse.githubapp:quarkus-github-app (Maven)

Affected versions

< 2.0.1
< 1.17.1

Patched versions

2.0.1
1.17.1

Description

Impact

The payload from the request is deserialized too early before the signature check has taken place.

While not a vulnerability per se, it can be a problem in case there is a vulnerability in the underlying library we are using to deserialize the payload, namely Jackson.

Patches

Users should upgrade to either Quarkus GitHub App 2.0.1 or 1.17.1.

Workarounds

No workarounds.

Severity

Low

CVE ID

No known CVE

Weaknesses

No CWEs

Credits