CVE-2024-36127

apko Exposure of HTTP basic auth credentials in log output

State: Published
Severity: 7.5 High
Published: Jun 3, 2024
Updated: Sep 3, 2024
Reserved: May 20, 2024

Description

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-522 Insufficiently Protected Credentials
CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
apkochainguard-dev	< 0.14.5Affected

References

https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.