Renovate before 44.3.1 Authentication Bypass via Digest Updates
Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0), digest updates are not subject to the internal `minimumReleaseAge` (stability age) checks. When a repository configures `minimumReleaseAge` and has dependencies with `updateType=digest` — for example GitHub Actions pinned to a commit SHA with a floating tag, Docker images, Go modules or NuGet packages — Renovate will still open a pull request for a newly published digest, marked only with a pending `renovate/stability-days` status check. A newly published, potentially malicious dependency version can therefore cause a PR to be raised and CI workflows to potentially run before the configured minimum release age has elapsed, which is precisely what the Minimum Release Age control is intended to prevent. The issue is fixed in Renovate 44.3.1; as a workaround, digest updates can be disabled or gated behind `dependencyDashboardApproval`.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
renovate
Vendor
renovatebot
Product
renovate
Platforms
Unknown
Default status
unaffected
renovate · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
44.3.1
Unavailable
None listed
44.3.1
unaffected
semver
Unavailable
Unavailable
None listed
renovate-ce
Vendor
mend
Product
renovate-ce
Platforms
Unknown
Default status
unaffected
renovate-ce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
renovate-ee-server
Vendor
mend
Product
renovate-ee-server
Platforms
Unknown
Default status
unaffected
renovate-ee-server · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
renovate-ee-worker
Vendor
mend
Product
renovate-ee-worker
Platforms
Unknown
Default status
unaffected
renovate-ee-worker · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
mend-renovate-ce
Vendor
mend
Product
mend-renovate-ce
Platforms
Unknown
Default status
unaffected
mend-renovate-ce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
mend-renovate-enterprise-edition
Vendor
mend
Product
mend-renovate-enterprise-edition
Platforms
Unknown
Default status
unaffected
mend-renovate-enterprise-edition · Scoped product and version facts