128 matches found
SUSE CVE-2024-23840
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
Sensitive Information Into Log File
github.com/goreleaser/goreleaser is vulnerable to Information Exposure. The vulnerability is due to a flaw in the handling of debug logs WithField"env", c.Env which is used to log environment variables., The goreleaser release --debug command includes sensitive information such as secrets or...
CVE-2024-23840
A flaw was found in GoReleaser. This package log shows secret values that are supposed to be hidden when using --debug. Mitigation No mitigation is yet available for this vulnerability despite having control of the --debug and where the logs are located...
GHSA-H3Q2-8WHX-C29H vulnerabilities
Vulnerabilities for packages: goreleaser...
GHSA-H3Q2-8WHX-C29H vulnerabilities
Vulnerabilities for packages: goreleaser...
GHSA-H3Q2-8WHX-C29H `goreleaser release --debug` shows secrets
Summary Hello 👋 goreleaser release --debug log shows secret values used in the in the custom publisher. How to reproduce the issue: - Define a custom publisher as the one below. Make sure to provide a custom script to the cmd field and to provide a secret to env .goreleaser.yml publishers: - name...
CVE-2024-23840 vulnerabilities
Vulnerabilities for packages: goreleaser...
CVE-2024-23840 vulnerabilities
Vulnerabilities for packages: goreleaser...
CVE-2024-23840
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
Code injection
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
CVE-2024-23840 `goreleaser release --debug` shows secrets
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
CVE-2024-23840
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. "goreleaser release --debug" log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
CVE-2024-23840 `goreleaser release --debug` shows secrets
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
CVE-2024-23840
GoReleaser (the goreleaser tool) is affected by CVE-2024-23840: when using a custom publisher, the --debug log can print secret values (e.g., environment secrets) in the output, potentially leaking sensitive data. The issue is documented across multiple feeds (including NVD and related advisories...
CVE-2024-23840 `goreleaser release --debug` shows secrets
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
PT-2024-1505 · Unknown · Goreleaser
Name of the Vulnerable Software and Affected Versions: GoReleaser versions prior to 1.24.0 Description: The issue is related to information disclosure through log files. When using a custom publisher with goreleaser release --debug, secret values used in the custom publisher are printed to the lo...
CVE-2024-23840: Insertion of Sensitive Information into Log File
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
GoReleaser Log Information Disclosure Vulnerability
GoReleaser is a binary delivery tool for GO applications. GoReleaser suffers from a log message disclosure vulnerability that stems from displaying secret values in logs...