Bug 2097414 (CVE-2022-31051)

Summary:	CVE-2022-31051 semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri encoding
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	emartyny, fboucher, kaycoth, ldap-maint, michal.skrivanek, mperina, mpitt, openstack-sig, pabelanger, psegedy, sbonazzo, sgratch, tkasparek, tsasak
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	semantic-release 19.0.3	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in semantic-release. Secrets that are normally masked are accidentally disclosed if they contain characters excluded from uri encoding by `encodeURI()`. The vulnerability is further limited to execution contexts where push access to the related repository is unavailable without modifying the repository URL to inject credentials.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-30 04:25:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2097509, 2097510, 2101658
Bug Blocks:	2097415

Description Pedro Sampaio 2022-06-15 16:05:38 UTC

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by `encodeURI`. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL are already masked properly.

References:

https://github.com/semantic-release/semantic-release/security/advisories/GHSA-x2pg-mjhr-2m5x
https://github.com/semantic-release/semantic-release/commit/58a226f29c04ee56bbb02cc661f020d568849cad
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI
https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3

Comment 4 TEJ RATHI 2022-06-28 04:14:53 UTC

Created zuul tracking bugs for this issue:

Affects: fedora-all [bug 2101658]

Comment 6 errata-xmlrpc 2022-07-14 12:54:26 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.4

Via RHSA-2022:5555 https://access.redhat.com/errata/RHSA-2022:5555

Comment 7 Product Security DevOps Team 2022-08-30 04:25:51 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-31051