Insertion of Sensitive Information into Log File Affecting github.com/nginx/agent/v2/src/core package, versions <2.23.3
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMNGINXAGENTV2SRCCORE-5296228
- published 30 Mar 2023
- disclosed 30 Mar 2023
- credit Unknown
Introduced: 30 Mar 2023
CVE-2023-1550 Open this link in a new tabHow to fix?
Upgrade github.com/nginx/agent/v2/src/core to version 2.23.3 or higher.
Overview
github.com/nginx/agent/v2/src/core is a companion daemon for your NGINX Open Source or NGINX Plus instance.
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File because it inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys.
Note: Exploiting this vulnerability is only possible when the non-default trace level logging is enabled.
References
CVSS Scores
version 3.1