209 matches found
CVE-2023-24827
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
Design/Logic Flaw
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827
Syft (CLI + Go library for SBOMs) had a password disclosure vulnerability in v0.69.0–v0.69.1 where SYFT_ATTEST_PASSWORD could leak credentials in logs (DEBUG+ levels) and in attestations/SBOM payloads when using syft-json. The issue affects users who set SYFT_ATTEST_PASSWORD; users without it are...
CVE-2023-24827
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827: Exposure of Sensitive Information to an Unauthorized Actor
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
Syft log information leakage vulnerability
syft is a CLI tool and Go library for generating a software bill of materials SBOM from container images and filesystems. A log message disclosure vulnerability exists in syft, which stems from a password disclosure stored in the SYFTATTESTPASSWORD environment variable...