PT-2023-19808 · Syft · Syft

Wagoodman · Published 2023-02-07 · Updated 2024-08-20 · CVE-2023-24827

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions syft versions v0.69.0 through v0.69.1

Description A password disclosure flaw was found in syft, which leaks the password stored in the SYFT ATTEST PASSWORD environment variable. This variable is used to decrypt the private key during the signing process while generating an SBOM attestation. The credentials are leaked in two ways: in the syft logs when -vv or -vvv are used in the syft command and in the attestation or SBOM only when the syft-json format is used. This vulnerability affects users running syft that have the SYFT ATTEST PASSWORD environment variable set with credentials. Note that any generated attestations by the syft attest command are uploaded to the OCI registry, which means that any attestations generated for the affected versions of syft when the SYFT ATTEST PASSWORD environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry.

Recommendations For syft versions v0.69.0 through v0.69.1, upgrade to version v0.70.0 to resolve the issue. As a temporary workaround, consider removing the SYFT ATTEST PASSWORD environment variable to prevent credential leakage. Restrict access to the syft logs and attestation or SBOM files to minimize the risk of exploitation. Avoid using the syft-json format until the issue is resolved.

Exploit

Fix

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

CVE-2023-24827

GHSA-JP7V-3587-2956

GO-2023-1533

Affected Products

Syft

References · 9

• 🔥 https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24827.json · Exploit
• https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp7v-3587-2956 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24827 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24827 · Vendor Advisory
• https://github.com/anchore/syft · Note
• https://t.me/cibsecurity/57646 · Telegram Post