renovate[bot]
commented
4 days ago ℹ Artifact update notice
File name: go.mod
In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):
- 4 additional dependencies were updated
Details:
| Package | Change |
|---|---|
github.com/fatih/color |
v1.14.1 -> v1.16.0 |
golang.org/x/sys |
v0.18.0 -> v0.20.0 |
github.com/hashicorp/go-hclog |
v1.2.0 -> v1.6.3 |
github.com/mattn/go-isatty |
v0.0.17 -> v0.0.20 |
This PR contains the following updates:
v0.7.2->v0.7.7Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp
GO-2024-2947
More information
#### Details URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file. #### Severity Unknown #### References - [https://github.com/advisories/GHSA-v6v8-xj6m-xwqh](https://togithub.com/advisories/GHSA-v6v8-xj6m-xwqh) - [https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a](https://togithub.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a) - [https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027](https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2024-2947) and the [Go Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY 4.0](https://togithub.com/golang/vulndb#license)).go-retryablehttp can leak basic auth credentials to log files
GHSA-v6v8-xj6m-xwqh
More information
#### Details go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104) - [https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a](https://togithub.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a) - [https://discuss.hashicorp.com/c/security](https://discuss.hashicorp.com/c/security) - [https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027](https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027) - [https://github.com/advisories/GHSA-v6v8-xj6m-xwqh](https://togithub.com/advisories/GHSA-v6v8-xj6m-xwqh) - [https://github.com/hashicorp/go-retryablehttp](https://togithub.com/hashicorp/go-retryablehttp) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-v6v8-xj6m-xwqh) and the [GitHub Advisory Database](https://togithub.com/github/advisory-database) ([CC-BY 4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).Release Notes
hashicorp/go-retryablehttp (github.com/hashicorp/go-retryablehttp)
### [`v0.7.7`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.6...v0.7.7) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.6...v0.7.7) ### [`v0.7.6`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.6) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.6) ### [`v0.7.5`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.5) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.5) ### [`v0.7.4`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.3...v0.7.4) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.3...v0.7.4) ### [`v0.7.3`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.2...v0.7.3) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.2...v0.7.3)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.