GitHub Advisoryadvisory · GitHub Actions

GHSA-4mgv-m5cm-f9h7 Vault GitHub Action did not correctly mask multi-line secrets in output

HIGH Published 2022-05-24 Modified 2024-01-25 Official page ↗
Aliases
CVE-2021-32074
Ecosystem
GitHub Actions
Packages
hashicorp/vault-action
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2022-07-29

Affected packages

• GitHub Actions hashicorp/vault-action: < 2.2.0 → fixed in 2.2.0

Description

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. The vault-action implementation did not correctly handle the marking of multi-line variables. As a result, multi-line secrets were not correctly masked in vault-action output. Remediation: Customers using vault-action should evaluate the risk associated with this issue, and consider upgrading to vault-action 2.2.0 or newer. Please refer to https://github.com/marketplace/actions/hashicorp-vault for more information.

Related

Alias · CVE (1)

  • CVE-2021-32074 HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References