TI-2024-14312 Aliases CVE-2024-21583 GHSA-8pgc-65mj-53h5

Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before…

LOW 20CWE-15Published 2024-07-19 · Updated 2024-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00597 48th percentileScored 2026-11-07

Fix Fixed github.com/gitpod-io/gitpod/components/server/go/pkg/lib: main-gha.27122github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy: main-gha.27122+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	github.com/gitpod-io/gitpod/components/server/go/pkg/lib	before main-gha.27122	main-gha.27122	Patch available	CNA
—	github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy	before main-gha.27122	main-gha.27122	Patch available	CNA
—	github.com/gitpod-io/gitpod/install/installer/pkg/components/auth	before main-gha.27122	main-gha.27122	Patch available	CNA
—	github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server	before main-gha.27122	main-gha.27122	Patch available	CNA
—	github.com/gitpod-io/gitpod/install/installer/pkg/components/server	before main-gha.27122	main-gha.27122	Patch available	CNA
—	@gitpod/gitpod-protocol	before 0.1.5-main-gha.27122	0.1.5-main-gha.27122	Patch available	CNA
—	github.com/gitpod-io/gitpod (Go)	up to 0.8.0	—	No fix listed	GHSA-8pgc-65mj-53h5

github.com/gitpod-io/gitpod/components/server/go/pkg/lib Vendor— Affected before main-gha.27122 Fixed in main-gha.27122 Patch available CNA
github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy Vendor— Affected before main-gha.27122 Fixed in main-gha.27122 Patch available CNA
github.com/gitpod-io/gitpod/install/installer/pkg/components/auth Vendor— Affected before main-gha.27122 Fixed in main-gha.27122 Patch available CNA
github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server Vendor— Affected before main-gha.27122 Fixed in main-gha.27122 Patch available CNA
github.com/gitpod-io/gitpod/install/installer/pkg/components/server Vendor— Affected before main-gha.27122 Fixed in main-gha.27122 Patch available CNA
@gitpod/gitpod-protocol Vendor— Affected before 0.1.5-main-gha.27122 Fixed in 0.1.5-main-gha.27122 Patch available CNA
github.com/gitpod-io/gitpod (Go) Vendor— Affected up to 0.8.0 Fixed in — No fix listed GHSA-8pgc-65mj-53h5

Remediation

Fix · CNA github.com/gitpod-io/gitpod/components/server/go/pkg/lib Fixed in main-gha.27122
Fix · CNA github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy Fixed in main-gha.27122
Fix · CNA github.com/gitpod-io/gitpod/install/installer/pkg/components/auth Fixed in main-gha.27122
Fix · CNA github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server Fixed in main-gha.27122
Fix · CNA github.com/gitpod-io/gitpod/install/installer/pkg/components/server Fixed in main-gha.27122
Fix · CNA @gitpod/gitpod-protocol Fixed in 0.1.5-main-gha.27122

Timeline

2026-10-02 Threatist record created from CVE-2024-21583
2026-10-03 Alias added: GHSA-8pgc-65mj-53h5

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-21583

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences