CVE-2024-23840 `goreleaser release --debug` shows secrets

2024-01-3016:39:09

CWE-532

GitHub_M

www.cve.org

cve-2024-23840

goreleaser

secrets

vulnerability

fix 1.24.0

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

9.0%

JSON

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

CNA Affected

[
  {
    "vendor": "goreleaser",
    "product": "goreleaser",
    "versions": [
      {
        "version": "1.23.0",
        "status": "affected"
      }
    ]
  }
]