PT-2025-5338 · Maven+2 · Maven+2
Gionn
·
Published
2025-01-24
·
Updated
2025-01-30
·
CVE-2025-24355
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Updatecli versions prior to 0.93.0
Description
The issue concerns the leakage of private Maven repository credentials in application logs when an updatecli pipeline execution fails. This occurs when the pipeline contains a
maven source configured with basic auth credentials and there is a failure in the Maven repository, such as wrong coordinates provided or a non-existing artifact or version. Credentials are properly sanitized when the operation is successful. The estimated number of potentially affected devices is not explicitly mentioned, but Updatecli has seen over 1.2 million downloads.Technical details about exploitation include the fact that during the execution of an updatecli pipeline, credentials are being leaked in the application execution logs in case of failure. For example, when the
repository field in the maven source is configured with basic auth credentials, and there is an error, the credentials may be exposed in the logs.Recommendations
For Updatecli versions prior to 0.93.0, update to version 0.93.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of basic auth credentials in the
repository field of the maven source until the issue is resolved. Restrict access to the application logs to minimize the risk of credential exposure.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Maven
Suse
Updatecli