go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp
More information
#### Details
URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file.
#### Severity
Unknown
#### References
- [https://github.com/advisories/GHSA-v6v8-xj6m-xwqh](https://togithub.com/advisories/GHSA-v6v8-xj6m-xwqh)
- [https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a](https://togithub.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a)
- [https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027](https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027)
This data is provided by [OSV](https://osv.dev/vulnerability/GO-2024-2947) and the [Go Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY 4.0](https://togithub.com/golang/vulndb#license)).
go-retryablehttp can leak basic auth credentials to log files
More information
#### Details
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
#### Severity
- CVSS Score: 6.0 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N`
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104)
- [https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a](https://togithub.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a)
- [https://discuss.hashicorp.com/c/security](https://discuss.hashicorp.com/c/security)
- [https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027](https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027)
- [https://github.com/advisories/GHSA-v6v8-xj6m-xwqh](https://togithub.com/advisories/GHSA-v6v8-xj6m-xwqh)
- [https://github.com/hashicorp/go-retryablehttp](https://togithub.com/hashicorp/go-retryablehttp)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-v6v8-xj6m-xwqh) and the [GitHub Advisory Database](https://togithub.com/github/advisory-database) ([CC-BY 4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
Backport a14755e4d57a38bc1dc057a724a57b10ab1d3bf5 from #13304
This PR contains the following updates:
v0.7.4->v0.7.7GitHub Vulnerability Alerts
CVE-2024-6104
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp
GO-2024-2947
More information
#### Details URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file. #### Severity Unknown #### References - [https://github.com/advisories/GHSA-v6v8-xj6m-xwqh](https://togithub.com/advisories/GHSA-v6v8-xj6m-xwqh) - [https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a](https://togithub.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a) - [https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027](https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2024-2947) and the [Go Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY 4.0](https://togithub.com/golang/vulndb#license)).go-retryablehttp can leak basic auth credentials to log files
GHSA-v6v8-xj6m-xwqh
More information
#### Details go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-6104](https://nvd.nist.gov/vuln/detail/CVE-2024-6104) - [https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a](https://togithub.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a) - [https://discuss.hashicorp.com/c/security](https://discuss.hashicorp.com/c/security) - [https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027](https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027) - [https://github.com/advisories/GHSA-v6v8-xj6m-xwqh](https://togithub.com/advisories/GHSA-v6v8-xj6m-xwqh) - [https://github.com/hashicorp/go-retryablehttp](https://togithub.com/hashicorp/go-retryablehttp) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-v6v8-xj6m-xwqh) and the [GitHub Advisory Database](https://togithub.com/github/advisory-database) ([CC-BY 4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).Release Notes
hashicorp/go-retryablehttp (github.com/hashicorp/go-retryablehttp)
### [`v0.7.7`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.6...v0.7.7) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.6...v0.7.7) ### [`v0.7.6`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.6) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.6) ### [`v0.7.5`](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.5) [Compare Source](https://togithub.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.5)Configuration
đ Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
đŠ Automerge: Disabled by config. Please merge this manually once you are satisfied.
â» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
đ Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.