PT-2024-5887 · Unknown+7 · Go-Retryablehttp+7
Published
2024-06-24
·
Updated
2026-04-07
·
CVE-2024-6104
CVSS v3.1
6.0
Medium
| Vector | AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
go-retryablehttp versions prior to 0.7.7
Description
The issue is related to the lack of sanitization of URLs when writing them to the log file. This could allow an attacker to obtain confidential HTTP basic authentication credentials.
Recommendations
For go-retryablehttp versions prior to 0.7.7, update to version 0.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of sensitive credential exposure.
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Suse
Go-Retryablehttp