GHSA-36rh-ggpr-j3gj

Source

https://github.com/advisories/GHSA-36rh-ggpr-j3gj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-36rh-ggpr-j3gj/GHSA-36rh-ggpr-j3gj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-36rh-ggpr-j3gj

Published

2020-09-14T16:38:40Z

Modified

2022-08-11T13:19:15Z

Summary

Renovate vulnerable to Azure DevOps token leakage in logs

Details

Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

Patches

Fixed in

Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.

Database specific

{
    "github_reviewed_at": "2020-09-14T16:38:10Z",
    "cwe_ids": [],
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

npm / renovate

Package

Name: renovate; View open source insights on deps.dev
Purl: pkg:npm/renovate

Affected ranges

Type: SEMVER
Events: Introduced

19.180.0

Fixed

23.25.1