medium5.7
CVE-2024-43784
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion
Impact
### Impact Existing lakeFS users who have issued credentials to users who have been deleted. Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds A possible workaround will be not to reuse usernames that were previously deleted ### References _Are there any links users can visit to find out more?_
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/treeverse/lakefs | < 1.33.0 | 1.33.0 |