CVE-2024-6395: GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys
An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.14 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.13.1 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.12.6 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.11.12 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.10.14 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.9.17
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6395?
CVE-2024-6395 is classified as a vulnerability that allows information exposure but does not compromise repository content.
How do I fix CVE-2024-6395?
To mitigate CVE-2024-6395, upgrade your GitHub Enterprise Server to version 3.10.15 or later, or to the latest version available.
Which versions of GitHub Enterprise Server are affected by CVE-2024-6395?
CVE-2024-6395 affects GitHub Enterprise Server versions from 3.9.0 to 3.9.17, from 3.10.0 to 3.10.14, from 3.11.0 to 3.11.12, from 3.12.0 to 3.12.6, and the exact version 3.13.0.
What type of information can be leaked due to CVE-2024-6395?
CVE-2024-6395 allows an attacker to enumerate the names of private repositories utilizing deploy keys.
Does CVE-2024-6395 allow unauthorized access to repository contents?
No, CVE-2024-6395 only exposes the repository names and does not allow access to the actual content.