Common Weakness Enumeration

CWE-532

Allowed

Insertion of Sensitive Information into Log File

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product writes sensitive information to a log file.

1961 vulnerabilities reference this CWE, most recent first.

GHSA-JJ89-4799-J2QV

Vulnerability from github – Published: 2023-04-20 00:30 – Updated: 2024-04-04 03:36
VLAI
Details

When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-3429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-19T22:15:10Z",
    "severity": "MODERATE"
  },
  "details": "When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.",
  "id": "GHSA-jj89-4799-j2qv",
  "modified": "2024-04-04T03:36:28Z",
  "published": "2023-04-20T00:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3429"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d86e10668"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JJVM-MG9C-JCJC

Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-17 00:31
VLAI
Details

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-85171"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-03T13:06:24Z",
    "severity": "HIGH"
  },
  "details": "n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.",
  "id": "GHSA-jjvm-mg9c-jcjc",
  "modified": "2026-09-17T00:31:25Z",
  "published": "2026-09-03T15:32:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85171"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.73-credential-exposure-via-error-logging"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-JJXF-26C9-77GM

Vulnerability from github – Published: 2024-09-02 06:30 – Updated: 2024-09-06 21:41
VLAI
Summary
Vault Leaks Client Token and Token Accessor in Audit Devices
Details

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.0 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.17.3"
            },
            {
              "fixed": "1.17.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-8365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-03T20:47:47Z",
    "nvd_published_at": "2024-09-02T05:15:17Z",
    "severity": "MODERATE"
  },
  "details": "Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC\u2019d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.",
  "id": "GHSA-jjxf-26c9-77gm",
  "modified": "2024-09-06T21:41:33Z",
  "published": "2024-09-02T06:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8365"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-jjxf-26c9-77gm"
    },
    {
      "type": "PACKAGE",
      "url": "github.com/hashicorp/vault"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vault Leaks Client Token and Token Accessor in Audit Devices"
}

GHSA-JM5J-JFRM-HM23

Vulnerability from github – Published: 2026-01-13 20:30 – Updated: 2026-01-13 20:30
VLAI
Summary
hermes's raw options logging may disclose secrets passed in via subcommand options argument
Details

Thanks, @thunze for reporting this!

hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form since https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 in: https://github.com/softwarepub/hermes/blob/3a92f42b2b976fdbc2c49a621de6d665364a7cee/src/hermes/commands/cli.py#L66

If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file.

Impact

As currently, hermes.log is not yet uploaded automatically as an artifact in CI, this vuln impacts:

  • local users working on shared access computers, where logs may be written to a commonly accessible file system
  • CI users whose CI logs are accessible to others, e.g., through group or organization rights

Potentially, if the changes merged from https://github.com/softwarepub/ci-templates/pull/13 are merged into ci-templates via https://github.com/softwarepub/ci-templates/pull/14, this would automate the disclosure of Invenio auth tokens at least for all CI runs against Invenio instances!

Patches

This has been patched in hermes 0.9.1 by masking all values passed using -O.

Workarounds

Upgrade to hermes >= 0.9.1.

Severity
5.9 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "hermes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.1"
            },
            {
              "fixed": "0.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22798"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-13T20:30:54Z",
    "nvd_published_at": "2026-01-12T22:16:08Z",
    "severity": "MODERATE"
  },
  "details": "Thanks, @thunze for reporting this!\n\n`hermes` subcommands take arbitrary options under the `-O` argument. These have been logged in raw form since https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 in: https://github.com/softwarepub/hermes/blob/3a92f42b2b976fdbc2c49a621de6d665364a7cee/src/hermes/commands/cli.py#L66\n\nIf users provide sensitive data such as API tokens (e.g., via `hermes deposit -O invenio_rdm.auth_token SECRET`), these are written to the log file in plain text, making them available to whoever can access the log file.\n\n### Impact\n\nAs currently, `hermes.log` is not yet uploaded automatically as an artifact in CI, this vuln impacts:\n\n- local users working on shared access computers, where logs may be written to a commonly accessible file system\n- CI users whose CI logs are accessible to others, e.g., through group or organization rights\n\nPotentially, if the changes merged from https://github.com/softwarepub/ci-templates/pull/13 are merged into `ci-templates` via https://github.com/softwarepub/ci-templates/pull/14, this would automate the disclosure of Invenio auth tokens at least for all CI runs against Invenio instances!\n\n### Patches\n\nThis has been patched in [`hermes` 0.9.1](TODO) by masking all values passed using `-O`.\n\n### Workarounds\n\nUpgrade to `hermes` \u003e= 0.9.1.",
  "id": "GHSA-jm5j-jfrm-hm23",
  "modified": "2026-01-13T20:30:54Z",
  "published": "2026-01-13T20:30:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22798"
    },
    {
      "type": "WEB",
      "url": "https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/softwarepub/hermes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "hermes\u0027s raw options logging may disclose secrets passed in via subcommand options argument"
}

GHSA-JMPC-VPWQ-88Q3

Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2023-02-03 21:30
VLAI
Details

On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration.

Severity
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-6648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-04T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration.",
  "id": "GHSA-jmpc-vpwq-88q3",
  "modified": "2023-02-03T21:30:35Z",
  "published": "2022-05-24T16:55:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6648"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K74327432"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K74327432?utm_source=f5support\u0026amp;utm_medium=RSS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JMRG-WP7G-G3WC

Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2024-04-04 00:03
VLAI
Details

In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-6157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-22T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "In various firmware versions of Lenovo System x, the integrated management module II (IMM2)\u0027s first failure data capture (FFDC) includes the web server\u0027s private key in the generated log file for support.",
  "id": "GHSA-jmrg-wp7g-g3wc",
  "modified": "2024-04-04T00:03:37Z",
  "published": "2022-05-24T16:44:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6157"
    },
    {
      "type": "WEB",
      "url": "https://support.lenovo.com/solutions/LEN-25667"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JMRX-5G74-6V2F

Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2025-02-28 18:06
VLAI
Summary
Kubernetes client-go library logs may disclose credentials to unauthorized users
Details

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/client-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/kubernetes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-11250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T00:35:06Z",
    "nvd_published_at": "2019-08-29T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.",
  "id": "GHSA-jmrx-5g74-6v2f",
  "modified": "2025-02-28T18:06:30Z",
  "published": "2022-05-24T16:55:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11250"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/issues/81114"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/pull/81330"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/commit/4441f1d9c3e94d9a3d93b4f184a591cab02a5245"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:4052"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:4087"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubernetes/kubernetes"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2021-0065"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20190919-0003"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/10/16/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kubernetes client-go library logs may disclose credentials to unauthorized users"
}

GHSA-JP24-RG62-2H88

Vulnerability from github – Published: 2024-10-31 03:30 – Updated: 2024-10-31 03:30
VLAI
Details

The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.1.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-10544"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-31T02:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.1.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.",
  "id": "GHSA-jp24-rg62-2h88",
  "modified": "2024-10-31T03:30:45Z",
  "published": "2024-10-31T03:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10544"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woo-manage-fraud-orders/trunk/includes/class-wmfo-debug-log.php#L25"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a62df5f6-64b0-4489-9dde-0d472040ee12?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JP7V-3587-2956

Vulnerability from github – Published: 2023-02-08 21:38 – Updated: 2023-02-08 21:38
VLAI
Summary
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set
Details

A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable.

Impact

The SYFT_ATTEST_PASSWORD environment variable is for the syft attest command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with syft attest --key <path-to-key-file>) during the signing process while generating an SBOM attestation.

This vulnerability affects users running syft that have the SYFT_ATTEST_PASSWORD environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable SYFT_ATTEST_PASSWORD set are not affected by this issue.

The credentials are leaked in two ways: - in the syft logs when -vv or -vvv are used in the syft command (which is any log level >= DEBUG) - in the attestation or SBOM only when the syft-json format is used

Note that as of v0.69.0 any generated attestations by the syft attest command are uploaded to the OCI registry (if you have write access to that registry) in the same way cosign attach is done. This means that any attestations generated for the affected versions of syft when the SYFT_ATTEST_PASSWORD environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry.

Example commands run from affected versions of syft that show the credential disclosure:

$ SYFT_ATTEST_PASSWORD=123456 syft <container-image-or-directory-input> -o syft-json | grep 123456
# "123456" is in the output

$ SYFT_ATTEST_PASSWORD=123456 syft attest <container-image-input> -o syft-json 
$ cosign download attestation <container-image-input> | jq -r '.payload' | base64 -d | grep 123456
# "123456" is in the output

Patches

The patch has been released in v0.70.0.

Workarounds

There are no workarounds for this vulnerability.

References

Patch pull request: https://github.com/anchore/syft/pull/1538

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/anchore/syft"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.69.0"
            },
            {
              "fixed": "0.70.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-24827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T21:38:46Z",
    "nvd_published_at": "2023-02-07T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable.\n\n### Impact\nThe `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key \u003cpath-to-key-file\u003e`)  during the signing process while generating an SBOM attestation. \n\nThis vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue.\n\nThe credentials are leaked in two ways:\n- in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level \u003e= `DEBUG`)\n- in the attestation or SBOM only when the `syft-json` format is used \n\nNote that as of v0.69.0 any generated attestations by the `syft attest` command are uploaded to the OCI registry (if you have write access to that registry) in the same way `cosign attach` is done. This means that any attestations generated for the affected versions of syft when the `SYFT_ATTEST_PASSWORD` environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry.\n\nExample commands run from affected versions of syft that show the credential disclosure:\n```bash\n$ SYFT_ATTEST_PASSWORD=123456 syft \u003ccontainer-image-or-directory-input\u003e -o syft-json | grep 123456\n# \"123456\" is in the output\n\n$ SYFT_ATTEST_PASSWORD=123456 syft attest \u003ccontainer-image-input\u003e -o syft-json \n$ cosign download attestation \u003ccontainer-image-input\u003e | jq -r \u0027.payload\u0027 | base64 -d | grep 123456\n# \"123456\" is in the output\n```\n\n### Patches\n\nThe patch has been released in v0.70.0.\n\n### Workarounds\n\nThere are no workarounds for this vulnerability.\n\n### References\n\nPatch pull request: https://github.com/anchore/syft/pull/1538",
  "id": "GHSA-jp7v-3587-2956",
  "modified": "2023-02-08T21:38:46Z",
  "published": "2023-02-08T21:38:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24827"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/anchore/syft"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set"
}

GHSA-JPCM-4485-69P7

Vulnerability from github – Published: 2021-03-09 00:38 – Updated: 2021-03-12 17:32
VLAI
Summary
Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
Details

Impact

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.

When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.

Patches

Fixed in version 3.0.0

References

  • https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44
  • https://github.com/bmuschko/gradle-vagrant-plugin/issues/19
  • https://github.com/bmuschko/gradle-vagrant-plugin/pull/20

For more information

If you have any questions or comments about this advisory: * Open an issue in bmuschko/gradle-vagrant-plugin

Severity
7.4 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.bmuschko:gradle-vagrant-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21361"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-09T00:38:15Z",
    "nvd_published_at": "2021-03-09T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.\n\nWhen this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.\n\n### Patches\nFixed in version 3.0.0\n\n### References\n\n - https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44\n - https://github.com/bmuschko/gradle-vagrant-plugin/issues/19\n - https://github.com/bmuschko/gradle-vagrant-plugin/pull/20\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [bmuschko/gradle-vagrant-plugin](https://github.com/bmuschko/gradle-vagrant-plugin)",
  "id": "GHSA-jpcm-4485-69p7",
  "modified": "2021-03-12T17:32:39Z",
  "published": "2021-03-09T00:38:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21361"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin"
}
Mitigation
Architecture and Design Implementation

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.

Mitigation
Distribution

Remove debug log files before deploying the application into production.

Mitigation
Operation

Protect log files against unauthorized read/write.

Mitigation
Implementation

Adjust configurations appropriately when software is transitioned from a debug state to production.

CAPEC-215: Fuzzing for application mapping

An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.

← Back to the CWE list