Open Redirectrenovate is a dependency updater.
Affected versions of this package are vulnerable to Open Redirect in the GitLab pagination handling, which follows the URL given in a Link header and attaches the GitLab credentials to the next-page request without confining the follow to the original origin. An attacker operating or having compromised a GitLab server can capture those credentials by returning a Link header pointing at a host they control, which the paginated requests then reach with the credentials attached. This requires the platform to be configured as GitLab against that server, whether for the hosted repository or for dependencies resolved from it, and the exposure is reduced by the fact that a compromised server already receives those credentials on the initial requests.
How to fix Open Redirect? Upgrade renovate to version 44.11.3 or higher.
| |
Open Redirectrenovate is a dependency updater.
Affected versions of this package are vulnerable to Open Redirect in the Docker registry pagination handling, which follows the URL given in an HTTP Link header while still attaching the registry credentials, without confining the follow to the original origin. An attacker operating or having compromised a container registry can capture those credentials by returning a Link header pointing at a host they control, which the tag and digest lookups then request with the credentials attached. This requires the project to have Docker image dependencies resolved against that registry, and the exposure is reduced by the fact that a compromised registry already receives those credentials on the initial authenticated requests.
How to fix Open Redirect? Upgrade renovate to version 44.11.2 or higher.
| |
Command Injectionrenovate is a dependency updater.
Affected versions of this package are vulnerable to Command Injection in the Mix manager's Hex registry authentication, which interpolates the organization value derived from the dependency name into the mix hex.organization auth invocation without escaping. An attacker can execute commands as the Renovate user, or append their own arguments to that authentication call, by placing a dependency name such as private_package:evil --key leaked_or_arbitrary in the manifest, which expands to mix hex.organization auth evil --key leaked_or_arbitrary --key secret_token. This requires a self-hosted Renovate with binarySource=docker, private Mix dependencies configured, and a dependency name that would not be valid for Mix.
How to fix Command Injection? Upgrade renovate to version 44.14.7 or higher.
| |
Open Redirectrenovate is a dependency updater.
Affected versions of this package are vulnerable to Open Redirect via the Link header when following pagination links from a server response. An attacker can obtain configured credentials by manipulating the Link header to redirect requests to an attacker-controlled host.
How to fix Open Redirect? Upgrade renovate to version 44.11.3 or higher.
| |
Insertion of Sensitive Information into Log Filerenovate is a dependency updater.
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File incomplete sanitization of TLS private keys in log output. An attacker can obtain sensitive cryptographic material by accessing logs where the private key may be present in cleartext under configuration options or log messages other than httpsPrivateKey. This is only exploitable if Mutual TLS is configured through hostRules[].httpsPrivateKey without using the documented secrets configuration.
How to fix Insertion of Sensitive Information into Log File? Upgrade renovate to version 44.14.4 or higher.
| |
Command Injectionrenovate is a dependency updater.
Affected versions of this package are vulnerable to Command Injection in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. An attacker can execute arbitrary commands as the application user by injecting shell metacharacters through malicious dependency names during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled. This is only exploitable if binarySource is set to docker and postUpdateOptions gomodUpdateImportPaths is enabled.
Note: binarySource=docker is deprecated.
How to fix Command Injection? Upgrade renovate to version 44.14.7 or higher.
| |
Command Injectionrenovate is a dependency updater.
Affected versions of this package are vulnerable to Command Injection via the distributionType parameter in maven-wrapper.properties. An attacker can execute arbitrary commands by injecting shell code when the application processes Maven Wrapper updates in binarySource=docker mode.
How to fix Command Injection? Upgrade renovate to version 44.14.7 or higher.
| |
Command Injectionrenovate is a dependency updater.
Affected versions of this package are vulnerable to Command Injection in the manager/gradle-wrapper process. An attacker can execute arbitrary commands as the Renovate user by supplying a crafted distributionUrl value in the gradle-wrapper.properties file, which is not properly escaped before being used by the Gradle Wrapper CLI. This is only exploitable if the deployment is self-hosted, configured with binarySource=docker, and allowedUnsafeExecutions includes gradleWrapper.
How to fix Command Injection? Upgrade renovate to version 44.14.7 or higher.
| |
Open Redirectrenovate is a dependency updater.
Affected versions of this package are vulnerable to Open Redirect in the process of handling pagination for NuGet registries via the HTTP Link header. An attacker can obtain registry credentials by configuring a malicious or compromised registry to supply a Link header pointing to an attacker-controlled server, causing credentials to be sent to that server. This is only exploitable if the NuGet registry in use is malicious or has been compromised.
How to fix Open Redirect? Upgrade renovate to version 44.11.2 or higher.
| |
Reliance on Untrusted Inputs in a Security Decisionrenovate is a dependency updater.
Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision in the minimumReleaseAge process. An attacker can trigger automated pull requests and CI workflow execution for newly published or malicious dependency versions by exploiting digest updates to bypass configured stability checks. This is only exploitable if minimumReleaseAge is configured and digest updates are in use.
How to fix Reliance on Untrusted Inputs in a Security Decision? Upgrade renovate to version 44.3.1 or higher.
| |
