{"id":"CVE-2022-24912","aliases":["EUVD-2022-6368","GHSA-jxqv-jcvh-7gr4","GO-2022-0534"],"status":"published","title":"Timing Attack","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01215,"percentile":0.68779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203","CWE-208"],"published":"2022-07-29T10:00:15Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Go","package":"github.com/runatlantis/atlantis","fixed_in":["0.19.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/runatlantis/atlantis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/runatlantis/atlantis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/runatlantis/atlantis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.7"}]}]}],"products":[{"vendor":"runatlantis","product":"atlantis"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUNATLANTISATLANTISSERVERCONTROLLERSEVENTS-2950851","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/runatlantis/atlantis/issues/2391","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/runatlantis/atlantis/commit/48870911974adddaa4c99c8089e79b7d787fa820","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24912","tags":["advisory"]},{"url":"https://github.com/runatlantis/atlantis/pull/2392","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0534","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jxqv-jcvh-7gr4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24912.json","tags":["advisory"]},{"url":"https://github.com/runatlantis/atlantis","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-24912","title":"Timing Attack","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","status":"published","published":"2022-07-29T10:00:15.439Z","modified":"2024-09-17T02:53:19.536Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-6368","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","status":"published","published":"2022-07-29T10:00:15Z","modified":"2024-09-17T02:53:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:36.484067Z"}],"ghsa":[{"id":"GHSA-jxqv-jcvh-7gr4","title":"Atlantis Events vulnerable to Timing Attack","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","status":"published","published":"2022-07-30T00:00:41Z","modified":"2023-08-30T18:11:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-203","CWE-208"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2022-24912","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","status":"published","published":"2022-07-29T10:15:12.557Z","modified":"2026-06-17T04:32:47.067Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:07:24.037422Z"}],"osv":[{"id":"CVE-2022-24912","title":"Timing Attack","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","status":"published","published":"2022-07-29T10:00:15.439Z","modified":"2026-10-28T02:31:03.821440637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-jxqv-jcvh-7gr4","title":"Atlantis Events vulnerable to Timing Attack","description":"The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.","status":"published","published":"2022-07-30T00:00:41Z","modified":"2026-09-10T03:50:06.965740708Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-203","CWE-208"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"GO-2022-0534","title":"Timing attack in github.com/runatlantis/atlantis","description":"Validation of Gitlab requests can leak secrets.\n\nThe package github.com/runatlantis/atlantis/server/controllers/events uses a non-constant time comparison for secrets while validating a Gitlab request. This allows for a timing attack where an attacker can recover a secret and then forge the request.","status":"published","published":"2022-08-11T20:54:51Z","modified":"2026-02-04T02:13:50.977488Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}