CVE-2024-36127
published 2024-06-03CVE-2024-36127: apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.44%
35.8th percentile
apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chainguard-dev | apko | < 0.14.5 | 0.14.5 |
| chainguard.dev | apko | >= 0 < 0.14.5 | 0.14.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
osv·2024-06-14
CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
GHSA
apko Exposure of HTTP basic auth credentials in log output
ghsa·2024-06-04
CVE-2024-36127 [HIGH] CWE-522 apko Exposure of HTTP basic auth credentials in log output
apko Exposure of HTTP basic auth credentials in log output
### Summary
Exposure of HTTP basic auth credentials from repository and keyring URLs in log output
### Details
There was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons:
1. The`%s` verb was used to format a `url.URL` as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL.
2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow.
apko, as well as its companion library `go-apk`, have been updated to ensure URLs are pa
OSV
apko Exposure of HTTP basic auth credentials in log output
osv·2024-06-04
CVE-2024-36127 [HIGH] apko Exposure of HTTP basic auth credentials in log output
apko Exposure of HTTP basic auth credentials in log output
### Summary
Exposure of HTTP basic auth credentials from repository and keyring URLs in log output
### Details
There was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons:
1. The`%s` verb was used to format a `url.URL` as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL.
2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow.
apko, as well as its companion library `go-apk`, have been updated to ensure URLs are pa
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqphttps://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
2024-06-03
Published