PT-2024-1505 · Unknown · Goreleaser

Andreaangiolillo · Published 2024-01-30 · Updated 2024-02-13 · CVE-2024-23840

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoReleaser versions prior to 1.24.0

Description The issue is related to information disclosure through log files. When using a custom publisher with goreleaser release --debug, secret values used in the custom publisher are printed to the log. This could allow an attacker to disclose protected information. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 1.24.0, update to version 1.24.0 to resolve the issue. As a temporary workaround, consider avoiding the use of the --debug flag with goreleaser release to minimize the risk of secret values being printed to the log.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2024-01013

CVE-2024-23840

GHSA-H3Q2-8WHX-C29H

GO-2024-2482

Affected Products

Goreleaser

References · 13

• 🔥 https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23840.json · Exploit
• https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0 · Patch
• https://bdu.fstec.ru/vul/2024-01013 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23840 · Security Note
• https://osv.dev/vulnerability/GO-2024-2482 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23840 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h3q2-8whx-c29h · Vendor Advisory
• https://github.com/goreleaser/goreleaser · Note
• https://twitter.com/CVEnew/status/1752374251061915789 · Twitter Post
• https://t.me/cvenotify/70106 · Telegram Post
• https://twitter.com/RedPacketSec/status/1754083410039951709 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752413776660320459 · Twitter Post