PT-2020-20980 · Microsoft · Azure Devops
Published
2020-09-14
·
Updated
2020-09-14
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Azure DevOps (affected versions not specified)
Description
The issue affects Azure DevOps users, where the bot's token may be exposed in server or pipeline logs due to the
http.extraheader=AUTHORIZATION parameter being logged without redaction. Users are advised to revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.Recommendations
For Azure DevOps users, revoke existing bot credentials and generate new ones after upgrading, especially if logs may have been saved to an accessible location.
Do not share Renovate logs with anyone who cannot be trusted with access to the token.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Azure Devops