CVE-2024-36127: apko Exposure of HTTP basic auth credentials in log output

June 4, 2024

Exposure of HTTP basic auth credentials from repository and keyring URLs in log output

References

github.com/advisories/GHSA-v6mg-7f7p-qmqp
github.com/chainguard-dev/apko
github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01
github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
nvd.nist.gov/vuln/detail/CVE-2024-36127

Code Behaviors & Features

Detect and mitigate CVE-2024-36127 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →