GHSA-v7x3-7hw7-pcjg

Source

https://github.com/advisories/GHSA-v7x3-7hw7-pcjg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-v7x3-7hw7-pcjg/GHSA-v7x3-7hw7-pcjg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v7x3-7hw7-pcjg

Published

2019-10-21T16:02:33Z

Modified

2022-08-11T13:20:10Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

Details

Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

Workarounds

Disable Go Modules support.

References

Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure

For more information

If you have any questions or comments about this advisory:

Open an issue in Renovate

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:57:15Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / renovate

Package

Name: renovate; View open source insights on deps.dev
Purl: pkg:npm/renovate

Affected ranges

Type: SEMVER
Events: Introduced

13.87.0

Fixed

19.38.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-v7x3-7hw7-pcjg/GHSA-v7x3-7hw7-pcjg.json"