Upstream information

CVE-2024-52009 at MITRE

Description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v4 Scores
CVSS detail CNA (GitHub)
Base Score 8.5
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required Low
User Interaction None
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact High
Subsequent System Integrity Impact High
Subsequent System Availability Impact High
CVSSv4 Version 4.0
No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
Container suse/sl-micro/6.0/baremetal-os-container:latest
  • NetworkManager >= 1.42.6-slfo.1.1_2.1
  • NetworkManager-wwan >= 1.42.6-slfo.1.1_2.1
  • less >= 633-3.1
  • libnm0 >= 1.42.6-slfo.1.1_2.1
Container suse/sl-micro/6.0/base-os-container:latest
Container suse/sl-micro/6.0/kvm-os-container:latest
Container suse/sl-micro/6.0/rt-os-container:latest
  • NetworkManager >= 1.42.6-slfo.1.1_2.1
  • libnm0 >= 1.42.6-slfo.1.1_2.1
Container suse/sl-micro/6.0/toolbox:latest
  • less >= 633-3.1
Image SL-Micro
Image SL-Micro-Base
Image SL-Micro-Base-RT
Image SL-Micro-Base-RT-SelfInstall
Image SL-Micro-Base-RT-encrypted
Image SL-Micro-Base-SelfInstall
Image SL-Micro-Base-encrypted
Image SL-Micro-Base-qcow
Image SL-Micro-Default
Image SL-Micro-Default-SelfInstall
Image SL-Micro-Default-encrypted
Image SL-Micro-Default-qcow
  • NetworkManager >= 1.42.6-slfo.1.1_2.1
  • NetworkManager-tui >= 1.42.6-slfo.1.1_2.1
  • less >= 633-3.1
  • libnm0 >= 1.42.6-slfo.1.1_2.1
  • typelib-1_0-NM-1_0 >= 1.42.6-slfo.1.1_2.1
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-EC2
  • NetworkManager >= 1.42.6-slfo.1.1_2.1
  • NetworkManager-tui >= 1.42.6-slfo.1.1_2.1
  • cloud-netconfig-ec2 >= 1.15-slfo.1.1_1.1
  • less >= 633-3.1
  • libnm0 >= 1.42.6-slfo.1.1_2.1
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-GCE
  • NetworkManager >= 1.42.6-slfo.1.1_2.1
  • NetworkManager-tui >= 1.42.6-slfo.1.1_2.1
  • cloud-netconfig-gce >= 1.15-slfo.1.1_1.1
  • less >= 633-3.1
  • libnm0 >= 1.42.6-slfo.1.1_2.1
Image SLE-Micro
Image SLE-Micro-Azure
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-Azure
  • NetworkManager >= 1.42.6-slfo.1.1_2.1
  • NetworkManager-tui >= 1.42.6-slfo.1.1_2.1
  • cloud-netconfig-azure >= 1.15-slfo.1.1_1.1
  • less >= 633-3.1
  • libnm0 >= 1.42.6-slfo.1.1_2.1
SUSE Linux Enterprise Server 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20241120T172248-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-14515

SUSE Timeline for this CVE

CVE page created: Sat Nov 9 02:00:07 2024
CVE page last modified: Sat Nov 8 22:01:41 2025