CVE-2024-37904

Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the `github.com/go-git/go-git/v5` library on lines `L55-L89`. The Git provider does the following on the lines `L56-L62`. First, it sets the `CloneOptions`, specifying the url, the depth etc. It then validates the options. It then sets up an in-memory filesystem, to which it clones and Finally, it clones the repository. The `(g *Git) Clone()` method is vulnerable to a DoS attack: A Minder user can instruct Minder to clone a large repository which will exhaust memory and crash the Minder server. The root cause of this vulnerability is a combination of the following conditions: 1. Users can control the Git URL which Minder clones, 2. Minder does not enforce a size limit to the repository, 3. Minder clones the entire repository into memory. This issue has been addressed in commit `7979b43` which has been included in release version v0.0.52. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-400

• https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89
• https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L56-L62
• https://github.com/stacklok/minder/commit/7979b43
• https://github.com/stacklok/minder/security/advisories/GHSA-hpcg-xjq5-g666
• https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89
• https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L56-L62
• https://github.com/stacklok/minder/commit/7979b43
• https://github.com/stacklok/minder/security/advisories/GHSA-hpcg-xjq5-g666

Published

Jun 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37899XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2024-3790Vulnerability in WBSAirback 21.02.04, which consists of a st…4.8
• CVE-2024-37900XWiki Platform is a generic wiki platform offering runtime s…4.6
• CVE-2024-37901XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2024-37902DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Fra…10
• CVE-2024-37903Mastodon is a self-hosted, federated microblogging platform.…8.2
• CVE-2024-37905authentik is an open-source Identity Provider that emphasize…8.8
• CVE-2024-37906Admidio is a free, open source user management system for we…8.8
• CVE-2024-3791Vulnerability in WBSAirback 21.02.04, which consists of a st…4.8
• CVE-2024-37917Pexip Infinity before 35.0 has improper input validation tha…7.5
• CVE-2024-37918Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-37919Improper Neutralization of Input During Web Page Generation …5.9