GitHub Advisoryadvisory · Go
GHSA-h3q2-8whx-c29h `goreleaser release --debug` shows secrets
MEDIUM
Official page ↗
- Aliases
- CVE-2024-23840
- Ecosystem
- Go
- Packages
- github.com/goreleaser/goreleaser
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-532
- Reviewed
- 2024-01-30
Affected packages
• Go github.com/goreleaser/goreleaser: >= 1.23.0, < 1.24.0 → fixed in 1.24.0
Description
Summary
Hello 👋
`goreleaser release --debug` log shows secret values used in the in the custom publisher.
How to reproduce the issue:
• Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env`
```
.goreleaser.yml
publishers:
• name: my-publisher
# IDs of the artifacts we want to sign
ids:
• linux_archives
• linux_package
cmd: "./build/package/linux_notarize.sh"
env:
• VERSION={{ .Version }}
• SECRET_1={{.Env.SECRET_1}}
• SECRET_2={{.Env.SECRET_2}}
```
• run `goreleaser release --debug`
You should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`
Example:
```
running cmd= ....
SECRET_1=secret_value
```
Related
Alias · CVE (1)
- CVE-2024-23840 GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. vulnerability
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness