CVE-2023-24827
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-24827
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24827.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-24827
- Aliases
- Related
- Published
- 2023-02-07T01:15:09Z
- Modified
- 2025-01-15T04:44:26.181157Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The
SYFT_ATTEST_PASSWORDenvironment variable is for thesyft attestcommand to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided withsyft attest --key <path-to-key-file>) during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have theSYFT_ATTEST_PASSWORDenvironment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variableSYFT_ATTEST_PASSWORDset are not affected by this issue. The credentials are leaked in two ways: in the syft logs when-vvor-vvvare used in the syft command (which is any log level >=DEBUG) and in the attestation or SBOM only when thesyft-jsonformat is used. Note that as of v0.69.0 any generated attestations by thesyft attestcommand are uploaded to the OCI registry (if you have write access to that registry) in the same waycosign attachis done. This means that any attestations generated for the affected versions of syft when theSYFT_ATTEST_PASSWORDenvironment variable was set would leak credentials in the attestation payload uploaded to the OCI registry. This issue has been patched in commit9995950c70and has been released as v0.70.0. There are no workarounds for this vulnerability. Users are advised to upgrade. - References
Affected packages
Git / github.com/anchore/syft
Affected ranges
- Type
- GIT
- Repo
- https://github.com/anchore/syft
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed