Repository navigation
Update dependency @backstage/plugin-permission-backend to ^0.6.0 [SECURITY] - #13
Open
renovate-wibrow[bot] wants to merge 1 commit into
Open
renovate-wibrow[bot] wants to merge 1 commit into
renovate-wibrow[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.5.43→^0.6.0Permission policy information leakage in Backstage permission system
CVE-2025-32791 / GHSA-f8j4-p5cr-p777
More information
Details
Impact
A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact.
Patches
This issue has been resolved in version
0.6.0of the permissions backend.Workarounds
Administrators of the permission policies can ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.
References
If you have any questions or comments about this advisory:
Open an issue in the Backstage repository
Visit our Discord, linked to in Backstage README
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/plugin-permission-backend)
v0.6.0Compare Source
Minor Changes
78eaa50: Improved validation for the/authorizeendpoint when aresourceRefis provided alongside a basic permission. Additionally, introduced a clearer error message for cases where users attempt to directly evaluate conditional permissions.Patch Changes
v0.5.55Compare Source
Patch Changes
v0.5.54Compare Source
Patch Changes
v0.5.53Compare Source
Patch Changes
d9d62ef: Remove some internal usages of the backend-common packagev0.5.52Compare Source
Patch Changes
1e624ca: Restrict@types/expressversion range from*to^4.17.6.5c9cc05: Use native fetch instead of node-fetchv0.5.51Compare Source
Patch Changes
v0.5.50Compare Source
Patch Changes
094eaa3: Remove references to in-repo backend-common3109c24: The export for the new backend system at the/alphaexport is now also available via the main entry point, which means that you can remove the/alphasuffix from the import.v0.5.49Compare Source
Patch Changes
d425fc4: Modules, plugins, and services are nowBackendFeature, not a function that returns a feature.c2b63ab: Updated dependencysupertestto^7.0.0.fcb9356: DeprecatedcreateRouterand its router options in favour of the new backend system.v0.5.48Compare Source
v0.5.47Compare Source
Patch Changes
93095ee: Make sure node-fetch is version 2.7.0 or greaterv0.5.46Compare Source
Patch Changes
ed10fd2: ThePermissionPolicyinterface has been updated to align with the recent changes to the Backstage auth system. The second argument to thehandlemethod is now of the newPolicyQueryUsertype. This type maintains the old fields from theBackstageIdentityResponse, which are now all deprecated. Instead, two new fields have been added, which allows access to the same information:credentials- ABackstageCredentialsobject, which is useful for making requests to other services on behalf of the user as part of evaluating the policy. This replaces the deprecatedtokenfield. See the Auth Service documentation for information about how to create a token using these credentials.info- ABackstageUserInfoobject, which contains the same information as the deprecatedidentity, except for thetypefield that was redundant.Most existing policies can be updated by replacing the
BackstageIdentityResponsetype withPolicyQueryUser, which is exported from@backstage/plugin-permission-node, as well as replacing any occurrences ofuser?.identitywithuser?.info.Updated dependencies
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.