grafana / loki

Like Prometheus, but for logs.
https://grafana.com/loki
GNU Affero General Public License v3.0
22.71k stars 3.3k forks source link

Fix CVE-2024-6104 - github.com/hashicorp/go-retryablehttp #13335

Open rgoltz opened 4 days ago

rgoltz commented 4 days ago

Is your feature request related to a problem? Please describe. The current grafana loki docker image seems to be affected by go-retryablehttp can leak basic auth credentials to log files Vulnerability. It's tested with Loki version main-4eb45cc branch main revision 4eb45cc58

Describe the solution you'd like

Details from Image-Scan
Vulnerability ID https://nvd.nist.gov/vuln/detail/CVE-2024-6104
GitHub Advisory https://github.com/advisories/GHSA-v6v8-xj6m-xwqh
CWE https://cwe.mitre.org/data/definitions/532.html
Severity Medium
Fix available Yes
Installed version v0.7.4
Fix available v0.7.7
Package Manager GOBINARY
File paths usr/bin/loki