GHSA-36RH-GGPR-J3GJ中危已审查

Renovate vulnerable to Azure DevOps token leakage in logs

OSV 1.4.0 · github-reviewed · 修改于 2022-08-11 21:19

发布时间

2020-09-15 00:38

GitHub 审查时间

2020-09-15 00:38

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/09/GHSA-36rh-ggpr-j3gj/GHSA-36rh-ggpr-j3gj.json

公告说明

Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

Patches

Fixed in

Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.

受影响的软件包

npm

renovate

ECOSYSTEM

19.180.0

标识信息

别名 / CVE

无

CWE

无

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-36rh-ggpr-j3gj",
  "aliases": [],
  "details": "### Impact\n\nApplies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the `http.extraheader=AUTHORIZATION` parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.\n\n### Patches\n\nFixed in \n\n### Workarounds\n\nDo not share Renovate logs with anyone who cannot be trusted with access to the token.\n",
  "summary": "Renovate vulnerable to Azure DevOps token leakage in logs",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "19.180.0"
            },
            {
              "fixed": "23.25.1"
            }
          ]
        }
      ],
      "package": {
        "name": "renovate",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2022-08-11T13:19:15Z",
  "severity": [],
  "published": "2020-09-14T16:38:40Z",
  "references": [
    {
      "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj",
      "type": "WEB"
    },
    {
      "url": "https://github.com/renovatebot/renovate",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-09-14T16:38:10Z"
  }
}