PkgSeer

Vulnerability GHSA-36rh-ggpr-j3gj

Medium Risk

6 years ago

Renovate vulnerable to Azure DevOps token leakage in logs

19.180.0 - 22.25.6

Summary

Renovate vulnerable to Azure DevOps token leakage in logs

Details

Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

Patches

Fixed in

Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

43.65.0 - 43.102.10 GHSA-5vjq-5jmg-39xq

Child processes spawned by Renovate incorrectly have full access to environment variables

42.68.1 - 42.96.2 and 43.0.0 - 43.4.3 GHSA-8wc6-vgrq-x6cf

Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file

31.51.0 - 40.32.7 GHSA-3f44-xw83-3pmg

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

39.53.0 - 40.32.7 GHSA-xjr7-3c3g-m763

Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies

32.135.0 - 40.32.7 GHSA-36j9-mx87-2cff

View all vulnerabilities for these packages

Impacted packages

renovate

Timeline

Published

6 years ago

Last Modified

1 day ago