GHSA-v554-xwgw-hc3w

Source
https://github.com/advisories/GHSA-v554-xwgw-hc3w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-v554-xwgw-hc3w/GHSA-v554-xwgw-hc3w.json
Aliases
Published
2024-05-15T17:09:24Z
Modified
2024-05-19T02:24:45.432649Z
Summary
source-controller leaks Azure Storage SAS token into logs
Details

Impact

When source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires.

Patches

This vulnerability was fixed in source-controller v1.2.5.

Workarounds

There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.

Credits

This issue was reported and fixed by Jagpreet Singh Tamber (@jagpreetstamber) from the Azure Arc team.

References

https://github.com/fluxcd/source-controller/pull/1430

For more information

If you have any questions or comments about this advisory:

  • Open an issue in the source-controller repository.
  • Contact us at the CNCF Flux Channel.
References

Affected packages

Go / github.com/fluxcd/source-controller

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.2.5