PT-2024-28955 · Steeltoe · Steeltoe.Discovery.Eureka

Timhess · Published 2024-07-17 · Updated 2024-07-18 · CVE-2024-40636

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Steeltoe.Discovery.Eureka versions prior to 3.2.8

Description The issue concerns credential leakage in logs when utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry. Only the first URL is masked in the error log, potentially exposing credentials of subsequent URLs. The code in question is located in the DiscoveryClient.cs file.

Recommendations For Steeltoe.Discovery.Eureka versions prior to 3.2.8, update to version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package to address the credential leakage issue. As a temporary workaround, consider restricting log access to minimize the risk of exposed credentials.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-40636

GHSA-VMCP-66R5-3PCP

Affected Products

Steeltoe.Discovery.Eureka

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-40636 · Security Note
• https://osv.dev/vulnerability/CVE-2024-40636 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vmcp-66r5-3pcp · Vendor Advisory
• https://github.com/SteeltoeOSS/Steeltoe/commit/c5d4a94e90ccb77f8e851bc681a2e348a95e7ecb · Note
• https://t.me/cvenotify/86559 · Telegram Post
• https://t.me/cvedetector/1115 · Telegram Post
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp · Note
• https://github.com/SteeltoeOSS/security-advisories · Note