CVE-2021-32074: Inclusion of Sensitive Information in Log Files

May 7, 2021 (updated May 14, 2021)

HashiCorp vault-action (aka Vault GitHub Action) allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.

References

discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did-not-correctly-mask-multi-line-secrets-in-output/24128
nvd.nist.gov/vuln/detail/CVE-2021-32074

Code Behaviors & Features

Detect and mitigate CVE-2021-32074 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →