CVE-2020-37267: Insertion of Sensitive Information into Log File

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

WS-2020-0161

A Sensitive Data Exposure was found in renovate before 23.25.1, Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their...

PT-2020-20980

Name of the Vulnerable Software and Affected Versions Azure DevOps affected versions not specified Description The issue affects Azure DevOps users, where the bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction...