Bug 2262014 (CVE-2024-23840)

Summary:	CVE-2024-23840 goreleaser: goreleaser release --debug shows secrets
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dhanak, dsimansk, kingland, kverlaen, matzew, mnovotny, pierdipi, rguimara, rhuss
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	goreleaser 1.24.0	Doc Type:	---
Doc Text:	A flaw was found in GoReleaser. This package log shows secret values that are supposed to be hidden when using --debug.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2262012

Description Patrick Del Bello 2024-01-30 22:32:56 UTC

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0
https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h