AIKIDO-2024-10113

github.com/hashicorp/go-retryablehttp is vulnerable to Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log FileCVE-2024-6104 Published May 31, 2024

Medium Risk

0.7.3 - 0.7.6

Fixed in 0.7.7

Are you affected? Scan for Free

TL;DR

Affected versions of the go-retryablehttp package could potentially log URL-embedded basic authentication credentials in the logs.

You are affected if you use the go-retryablehttp package.

github.com/hashicorp/go-retryablehttp is vulnerable to Insertion of Sensitive Information into Log File in versions 0.7.3 - 0.7.6.

Upgrade github.com/hashicorp/go-retryablehttp to the patch version (version 0.7.7).

Medium Risk

0.7.3 - 0.7.6

Fixed in 0.7.7

Are you affected? Scan for Free

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Company

Resources

Industries

Use Cases

Compare

Legal

Connect

Security

Stay up to date with all updates

I consent to receiving marketing communications based on Aikido’s Privacy Policy.

Keizer Karelstraat 15, 9000, Ghent, Belgium

95 Third St, 2nd Fl, San Francisco, CA 94103, US

Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK

Ghent, Belgium | San Francisco, US