Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: use constant time comparison of webhook secret in gitlab event validator #2392

Merged
merged 1 commit into from
Jul 15, 2022
Merged

fix: use constant time comparison of webhook secret in gitlab event validator #2392

merged 1 commit into from
Jul 15, 2022

Conversation

cedws
Copy link
Contributor

@cedws cedws commented Jul 14, 2022

Closes #2391.

@cedws cedws requested a review from a team as a code owner July 14, 2022 16:42
@lilincmu
Copy link
Contributor

Looks good to me. Thanks for identifying the vulnerability and contributing the fix!

@lilincmu lilincmu merged commit 4887091 into runatlantis:master Jul 15, 2022
krrrr38 pushed a commit to krrrr38/atlantis that referenced this pull request Dec 16, 2022
@cedws @krrrr38
fix: use constant time comparison of webhook secret in gitlab event v…
268502a 
…alidator (runatlantis#2392)
@nitrocode nitrocode modified the milestones: v0.19.8, v0.19.7 Mar 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lilincmu lilincmu lilincmu approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
v0.19.7
Development

Successfully merging this pull request may close these issues.

GitLab webhook event validator vulnerable to timing attacks
3 participants
@cedws @lilincmu @nitrocode