chore(deps): update rlespinasse/github-slug-action action to v5 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rlespinasse/github-slug-action	action	major	v4 → v5

GitHub Vulnerability Alerts

CVE-2023-27581

Impact

This action uses the github.head_ref parameter in an insecure way.

This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). This can be used to execute code on the GitHub runners (potentially use it for crypto-mining, and waste your resources) and to exfiltrate any secrets you use in the CI pipeline.

Patches

Pass the variable as an environment variable and then use the environment variable instead of substituting it directly.

Patched action is available on tag v4, tag v4.4.1, and any tag beyond.

Workarounds

No workaround is available if impacted, please upgrade the version

ℹ️ v3 and v4 are compatibles.

References

Here is a set of blog posts by Github's security team explaining this issue.

Thanks

Thanks to the team of researchers from Purdue University, who are working on finding vulnerabilities in CI/CD configurations of open-source software. Their tool detected this security vulnerability.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

---

Release Notes

rlespinasse/github-slug-action (rlespinasse/github-slug-action)

v5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.