Octo-STS Vulnerability Could Lead to Denial of Service
CVE-2024-34079

3.7LOW

Key Information:

Vendor

Octo-sts

Status
App
Vendor
CVE Published:
14 May 2024

What is CVE-2024-34079?

octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0

Affected Version(s)

app < 0.1.0

References

https://github.com/octo-sts/app/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/octo-sts/app/commit/74ba874c017cf973ed...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2024-34079 : Octo-STS Vulnerability Could Lead to Denial of Service