Exposure of Sensitive Information to an Unauthorized Actor Affecting github.com/wolfi-dev/wolfictl/pkg/advisory package, versions <0.16.10
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMWOLFIDEVWOLFICTLPKGADVISORY-6860241
- published 16 May 2024
- disclosed 15 May 2024
- credit Dan Luhring
Introduced: 15 May 2024
CVE-2024-35183 Open this link in a new tabHow to fix?
Upgrade github.com/wolfi-dev/wolfictl/pkg/advisory to version 0.16.10 or higher.
Overview
Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor due to the GetGitAuth function. An attacker can access sensitive information by sending a GitHub token to remote servers other than github.com.
Notes:
This impacts anyone who ran the wolfictl check update commands with a Melange configuration that included a git-checkout directive step that referenced a git repository not hosted on github.com.
This also impacts anyone who ran wolfictl update
with a remote URL outside of github.com. These subcommands must have run with the GITHUB_TOKEN environment variable set to a valid GitHub token.