PT-2024-2218 · Unknown · Go Sdk For Cloudevents
Mattmoor
+1
·
Published
2024-03-06
·
Updated
2025-12-04
·
CVE-2024-28110
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Go SDK for CloudEvents versions prior to 2.15.2
Description
The issue is related to the
cloudevents.WithRoundTripper function in the Go SDK for CloudEvents, which causes the SDK to leak credentials to arbitrary endpoints when used with an authenticated http.RoundTripper. This happens because the http.DefaultClient is modified with the authenticated transport, resulting in the sending of Authorization tokens to any endpoint it contacts. The estimated number of potentially affected devices worldwide is not available.Recommendations
For versions prior to 2.15.2, update to version 2.15.2 to patch the issue. As a temporary workaround, consider avoiding the use of
cloudevents.WithRoundTripper with an authenticated http.RoundTripper until the update is applied. Restrict access to the http.DefaultClient to minimize the risk of exploitation. Avoid using the Transport field in the http.DefaultClient until the issue is resolved.Exploit
Fix
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Go Sdk For Cloudevents