PT-2024-35379 · Cachi2 · Cachi2

Martinbasti · Published 2024-11-19 · Updated 2024-11-19 · CVE-2024-52582

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cachi2 versions prior to 0.14.0

Description Cachi2 is a command-line interface tool used to pre-fetch a project's dependencies, aiding in making the project's build process network-isolated. The issue arises when an unhandled exception is triggered, potentially showing secrets in logs because the tool logs locals of each function. This could uncover secrets, particularly if the tool is used in CI/build pipelines, which is its main use case.

Recommendations For versions prior to 0.14.0, update to version 0.14.0 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2024-52582

GHSA-W9QC-9M5H-QQMH

Affected Products

Cachi2

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52582.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52582 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52582 · Vendor Advisory
• https://github.com/containerbuildsystem/cachi2/commit/d6638e5e14474061a1ab1ba5d0ee72f58b9a11a9 · Note
• https://github.com/containerbuildsystem/cachi2/security/advisories/GHSA-w9qc-9m5h-qqmh · Note
• https://twitter.com/CVEnew/status/1858898482897318340 · Twitter Post
• https://typer.tiangolo.com/tutorial/exceptions/?h=#disable-local-variables-for-security · Note
• https://t.me/cvedetector/11454 · Telegram Post