Detections
Analytics

SCA: security update for github.com/go-vela/server, github.com/go-vela/worker (GHSA-5m7g-pj8w-7593)

critical Tenable Self-Hosted Container Security Plugin ID 410914

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In
 Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default
 configurations for Vela allow exploitation and container breakouts. Users should upgrade to Server 0.16.0,
 Worker 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to
 explicitly change the default settings to configure Vela as desired. Some of the fixes will interrupt
 existing workflows and will require Vela administrators to modify default settings. However, not applying
 the patch (or workarounds) will continue existing risk exposure. Some workarounds are available. Vela
 administrators can adjust the worker's `VELA_RUNTIME_PRIVILEGED_IMAGES` setting to be explicitly empty,
 leverage the `VELA_REPO_ALLOWLIST` setting on the server component to restrict access to a list of
 repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull_requests
 if they are not needed. (CVE-2022-39395)

See Also

https://github.com/advisories/GHSA-5m7g-pj8w-7593

Plugin Details

Severity: Critical

ID: 410914

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 8/19/2025

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.11

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-39395

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/9/2022

Vulnerability Publication Date: 11/9/2022

Reference Information

CVE: CVE-2022-39395

cwe: CWE-269