{"id":"CVE-2024-56802","summary":"Tapir allows DeployKey exposure","details":"Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key to get write access to the registry.  User must upgrade to 0.9.2.","aliases":["GHSA-rj9m-qf65-f5gg"],"modified":"2026-08-12T15:15:49.862028Z","published":"2024-12-31T15:10:42.511Z","database_specific":{"cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56802.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56802.json"},{"type":"ADVISORY","url":"https://github.com/PacoVK/tapir/security/advisories/GHSA-rj9m-qf65-f5gg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56802"},{"type":"FIX","url":"https://github.com/PacoVK/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pacovk/tapir","events":[{"introduced":"eab0c28e0596d3b0f44726d5be2c6f34bb942d5e"},{"fixed":"c36360b611fa0ba4f5e250fa43ecf8a294785a03"}],"database_specific":{"extracted_events":[{"introduced":"0.9.0"},{"fixed":"0.9.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["0.9.1","0.9.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56802.json","vanir_signatures_modified":"2026-08-12T15:15:49Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/main/java/core/backend/aws/dynamodb/repository/DynamodbRepository.java"},"deprecated":false,"digest":{"line_hashes":["297381013022121512573804595585577762160","242028227777347796155598953785864486414","96468947976714823752871244939925139135","327213229627847233911885569828335488180","53132915712777742580085731998477288816","293139631114140547300852059049512155281","168837994508231466641860279217177514835"],"threshold":0.9},"id":"CVE-2024-56802-2170b112","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"126597179216779494238743627527458362254","length":83},"id":"CVE-2024-56802-2498490e","signature_type":"Function","signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/test/java/core/backend/elasticsearch/ElasticSearchDeployKeyRepositoryTest.java","function":"ElasticSearchDeployKeyRepositoryTest"}},{"deprecated":false,"digest":{"line_hashes":["121866480911485348781116892505029045750","95512849475238292431935926253093258203","51508406429472723723425077010143395542","10569821427838697879347421322492072253","234237656180845233009564602626239515724","21339510619622035817713930714849578954","75057756502644034284527547172839180889","134191718912185367170146011604907125025","235183150848954380683688880152662825036"],"threshold":0.9},"id":"CVE-2024-56802-28591e40","signature_type":"Line","signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/test/java/core/backend/aws/dynamodb/repository/DynamodbDeployKeyRepositoryTest.java"}},{"source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/main/java/core/backend/elasticsearch/ElasticSearchRepository.java","function":"getDeployKeyByValue"},"deprecated":false,"digest":{"function_hash":"2903008248997953758430371242643259712","length":423},"id":"CVE-2024-56802-44273887","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/java/core/backend/azure/cosmosdb/CosmosDbRepository.java","function":"getDeployKeyByValue"},"deprecated":false,"digest":{"function_hash":"2903008248997953758430371242643259712","length":423},"id":"CVE-2024-56802-95826b55","signature_type":"Function","signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03"},{"digest":{"line_hashes":["320424734409450669530793812280477139602","40425595250960475851519530153802092992","235472904201156620245019270010148704833","84683892461241179645875629542561505648","162143082969862065063511116514690558182","301650189815931039860548219696553360685","111777762361908312160618375793600958084","144590895295525034915384930541372351385","303346937916298136624018912208726038047","254435855423672949509071235532833430445","145003253974385750944803192376857654808","152342587178253801587168974879847789601","182393773895661440505273694342921039000","65970463622645848708331594113734141235","161859167012052033199544933111518891182","285241820126465982716967219612273000105","256221140875901368732339198773072876083"],"threshold":0.9},"id":"CVE-2024-56802-b312129e","signature_type":"Line","signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/test/java/core/backend/elasticsearch/ElasticSearchDeployKeyRepositoryTest.java"},"deprecated":false},{"target":{"file":"src/main/java/core/backend/aws/dynamodb/repository/DynamodbRepository.java","function":"getDeployKeyByValue"},"deprecated":false,"digest":{"function_hash":"251587189718603857352491131134689695298","length":334},"id":"CVE-2024-56802-c81687ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03"},{"signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/main/java/core/backend/azure/cosmosdb/CosmosDbRepository.java"},"deprecated":false,"digest":{"line_hashes":["159905437562022779377760779643327188977","47811228824363961212055204127206751336","96468947976714823752871244939925139135","327213229627847233911885569828335488180","219078832801944922326397025997903795115","116635715027649493880325577431038755537","310231677560505903606317690313720563782"],"threshold":0.9},"id":"CVE-2024-56802-dfe61ac9","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/pacovk/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03","target":{"file":"src/main/java/core/backend/elasticsearch/ElasticSearchRepository.java"},"deprecated":false,"digest":{"line_hashes":["159597264638679598128961085512237459940","179034492708752083383966237876110282951","159905437562022779377760779643327188977","47811228824363961212055204127206751336","96468947976714823752871244939925139135","327213229627847233911885569828335488180","219078832801944922326397025997903795115","116635715027649493880325577431038755537","310231677560505903606317690313720563782","116715091168462142911167922075636346234","40955257031539867966530441998448383405","252365025258527448522203196490852378290"],"threshold":0.9},"id":"CVE-2024-56802-f59c57aa","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}