GHSA-V6MG-7F7P-QMQP apko Exposure of HTTP basic auth credentials in log output

Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output Details There was a handful of instances where the apko tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The%s verb...

SUSE CVE-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127

creationtimestamp| type| source ---|---|--- 2024-06-03 13:18:53+00:00| published-proof-of-concept| https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp...

CVE-2024-36127: Insufficiently Protected Credentials

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

PT-2024-26912

Name of the Vulnerable Software and Affected Versions apko versions prior to 0.14.5 Description The issue concerns the exposure of HTTP basic auth credentials from repository and keyring URLs in log output. This occurs due to the use of the %s verb to format a url.URL as a string, which includes...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: tkn-fips, tekton-chains-fips, kubescape, ko, policy-controller-fips, aactl, gitsign, chainctl, slsa-verifier, wolfictl, apko, vexctl, tekton-chains, policy-controller, goreleaser, spire-server-fips, melange, tkn, ko-fips, zarf, falcoctl, falcoctl-fips,...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: ko, kubescape, goreleaser, tkn, wolfictl, tekton-chains, falcoctl, melange, policy-controller, aactl, neuvector-sigstore-interface, zot, vexctl, spire-server, apko, skaffold, flux-source-controller, gitsign, slsa-verifier, zarf...

GHSA-88JX-383Q-W4QC vulnerabilities

Vulnerabilities for packages: ko, kubescape, goreleaser, tkn, wolfictl, tekton-chains, falcoctl, melange, policy-controller, aactl, neuvector-sigstore-interface, zot, vexctl, spire-server, apko, skaffold, flux-source-controller, gitsign, slsa-verifier, zarf...

CVE-2024-29903 vulnerabilities

Vulnerabilities for packages: tkn-fips, tekton-chains-fips, kubescape, ko, policy-controller-fips, aactl, gitsign, chainctl, slsa-verifier, wolfictl, apko, vexctl, tekton-chains, policy-controller, goreleaser, spire-server-fips, melange, tkn, ko-fips, zarf, falcoctl, falcoctl-fips,...

CVE-2024-29903 vulnerabilities

Vulnerabilities for packages: ko, kubescape, goreleaser, tkn, wolfictl, tekton-chains, falcoctl, melange, policy-controller, aactl, neuvector-sigstore-interface, zot, vexctl, spire-server, apko, skaffold, flux-source-controller, gitsign, slsa-verifier, zarf...

CVE-2024-29902 vulnerabilities

Vulnerabilities for packages: tkn-fips, tekton-chains-fips, kubescape, ko, policy-controller-fips, aactl, gitsign, chainctl, slsa-verifier, wolfictl, apko, vexctl, tekton-chains, policy-controller, goreleaser, spire-server-fips, melange, tkn, ko-fips, zarf, falcoctl, falcoctl-fips,...

CVE-2024-29902 vulnerabilities

Vulnerabilities for packages: ko, kubescape, goreleaser, tkn, wolfictl, tekton-chains, falcoctl, melange, policy-controller, aactl, neuvector-sigstore-interface, zot, vexctl, spire-server, apko, skaffold, flux-source-controller, gitsign, slsa-verifier, zarf...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane, crossplane-provider-aws-rds, flux, crossplane-provider-aws-route53, crossplane-provider-aws-s3, sops, crossplane-provider-aws-sqs, kaniko, terraform-provider-google, gitness, flux-image-automation-controller, crossplane-provider-aws-cloudformation,...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: slsa-verifier, tkn, apko, kubescape, ko, tekton-chains, policy-controller, falcoctl-fips, spire-server-fips, melange, skaffold, aactl, flux-source-controller, spire-server, cosign...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: skaffold, melange, flux-source-controller, policy-controller, aactl, tekton-chains, ko, slsa-verifier, tkn, kubescape, apko, spire-server, cosign...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: slsa-verifier, tkn, apko, kubescape, ko, tekton-chains, policy-controller, falcoctl-fips, spire-server-fips, melange, skaffold, aactl, flux-source-controller, spire-server, cosign...