Bug 2294000 (CVE-2024-6104)
| Summary: | CVE-2024-6104 go-retryablehttp: url might write sensitive information to log file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Patrick Del Bello <pdelbell> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | agarcial, ahrabovs, alcohan, amctagga, anjoseph, aoconnor, asegurap, aucunnin, bniver, caswilli, crizzo, dfreiber, dhanak, drosa, drow, dsimansk, dymurray, eglynn, flucifre, gkamathe, gmeno, gparvin, jburrell, jcantril, jforrest, jjoyce, jkoehler, jmatthew, jprabhak, jschluet, kaycoth, kingland, kshier, kverlaen, lbainbri, lchilton, lhh, lphiri, lsvaty, luizcosta, manissin, matzew, mbenjamin, mburns, mgarciac, mhackett, mnovotny, mrajanna, mstoklus, muagarwa, mwringe, nbecker, njean, nweather, odf-bz-bot, owatkins, pahickey, pgrist, pierdipi, rgarg, rguimara, rhaigner, rhos-maint, rhuss, rjohnson, rojacob, sapillai, sausingh, sdawley, sfeifer, sipoyare, sostapov, stcannon, tnielsen, tsweeney, vereddy, vkumar, whayutin, wtam, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | go-retryablehttp 0.7.7 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2294001, 2350492, 2294002, 2294003, 2294004, 2294005, 2294006, 2294007, 2294008, 2294009, 2294010, 2294011, 2294012, 2294013, 2294014, 2294110, 2294111, 2294112, 2294113, 2294114, 2294115, 2294116, 2294117, 2294118, 2296267, 2296270, 2309720, 2350489, 2350490 | ||
| Bug Blocks: | 2293999 | ||
|
Description
Patrick Del Bello
2024-06-24 21:41:33 UTC
Created doctl tracking bugs for this issue: Affects: fedora-all [bug 2294002] Created golang-github-acme-lego tracking bugs for this issue: Affects: fedora-all [bug 2294003] Created golang-github-hashicorp-retryablehttp tracking bugs for this issue: Affects: fedora-all [bug 2294004] Created golang-github-moby-buildkit tracking bugs for this issue: Affects: fedora-all [bug 2294005] Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2294006] Created opentofu tracking bugs for this issue: Affects: fedora-all [bug 2294007] Created osbuild-composer tracking bugs for this issue: Affects: fedora-all [bug 2294008] Created podman tracking bugs for this issue: Affects: fedora-all [bug 2294009] Created skopeo tracking bugs for this issue: Affects: fedora-all [bug 2294010] Created stargz-snapshotter tracking bugs for this issue: Affects: fedora-all [bug 2294011] Created trivy tracking bugs for this issue: Affects: fedora-all [bug 2294012] Created vagrant tracking bugs for this issue: Affects: fedora-all [bug 2294013] Created vultr-cli tracking bugs for this issue: Affects: fedora-all [bug 2294014] This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:4316 https://access.redhat.com/errata/RHSA-2024:4316 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:4321 https://access.redhat.com/errata/RHSA-2024:4321 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:4479 https://access.redhat.com/errata/RHSA-2024:4479 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:4613 https://access.redhat.com/errata/RHSA-2024:4613 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:4699 https://access.redhat.com/errata/RHSA-2024:4699 This issue has been addressed in the following products: RHOSS-1.33-RHEL-8 Via RHSA-2024:4872 https://access.redhat.com/errata/RHSA-2024:4872 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:4853 https://access.redhat.com/errata/RHSA-2024:4853 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:4858 https://access.redhat.com/errata/RHSA-2024:4858 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:4846 https://access.redhat.com/errata/RHSA-2024:4846 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:4848 https://access.redhat.com/errata/RHSA-2024:4848 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:4965 https://access.redhat.com/errata/RHSA-2024:4965 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:4960 https://access.redhat.com/errata/RHSA-2024:4960 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:4963 https://access.redhat.com/errata/RHSA-2024:4963 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:5194 https://access.redhat.com/errata/RHSA-2024:5194 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:5258 https://access.redhat.com/errata/RHSA-2024:5258 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:5107 https://access.redhat.com/errata/RHSA-2024:5107 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:5160 https://access.redhat.com/errata/RHSA-2024:5160 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:5199 https://access.redhat.com/errata/RHSA-2024:5199 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:5200 https://access.redhat.com/errata/RHSA-2024:5200 This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2024:5547 https://access.redhat.com/errata/RHSA-2024:5547 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:5634 https://access.redhat.com/errata/RHSA-2024:5634 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:5433 https://access.redhat.com/errata/RHSA-2024:5433 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:5444 https://access.redhat.com/errata/RHSA-2024:5444 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Ironic content for Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:5446 https://access.redhat.com/errata/RHSA-2024:5446 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:5808 https://access.redhat.com/errata/RHSA-2024:5808 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.4 Via RHSA-2024:6054 https://access.redhat.com/errata/RHSA-2024:6054 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:6004 https://access.redhat.com/errata/RHSA-2024:6004 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:6194 https://access.redhat.com/errata/RHSA-2024:6194 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:6009 https://access.redhat.com/errata/RHSA-2024:6009 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:6409 https://access.redhat.com/errata/RHSA-2024:6409 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:6406 https://access.redhat.com/errata/RHSA-2024:6406 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster engine for Kubernetes 2.5 for RHEL 9 Via RHSA-2024:6738 https://access.redhat.com/errata/RHSA-2024:6738 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:6642 https://access.redhat.com/errata/RHSA-2024:6642 This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:6811 https://access.redhat.com/errata/RHSA-2024:6811 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:3722 https://access.redhat.com/errata/RHSA-2024:3722 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:7184 https://access.redhat.com/errata/RHSA-2024:7184 This issue has been addressed in the following products: RHODF-4.14-RHEL-9 Via RHSA-2024:7624 https://access.redhat.com/errata/RHSA-2024:7624 This issue has been addressed in the following products: RHODF-4.13-RHEL-9 Via RHSA-2024:7744 https://access.redhat.com/errata/RHSA-2024:7744 This issue has been addressed in the following products: CLUSTER-OBSERVABILITY-OPERATOR-0.4-RHEL-8 Via RHSA-2024:8040 https://access.redhat.com/errata/RHSA-2024:8040 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9098 https://access.redhat.com/errata/RHSA-2024:9098 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9115 https://access.redhat.com/errata/RHSA-2024:9115 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:10518 https://access.redhat.com/errata/RHSA-2024:10518 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:10823 https://access.redhat.com/errata/RHSA-2024:10823 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:11562 https://access.redhat.com/errata/RHSA-2024:11562 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:0029 https://access.redhat.com/errata/RHSA-2025:0029 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2025:1116 https://access.redhat.com/errata/RHSA-2025:1116 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2024:6122 https://access.redhat.com/errata/RHSA-2024:6122 This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2025:1829 https://access.redhat.com/errata/RHSA-2025:1829 This issue has been addressed in the following products: RHODF-4.15-RHEL-9 Via RHSA-2025:1865 https://access.redhat.com/errata/RHSA-2025:1865 This issue has been addressed in the following products: RHODF-4.14-RHEL-9 Via RHSA-2025:1866 https://access.redhat.com/errata/RHSA-2025:1866 |