CVE-2024-36127 — apko Exposure of HTTP basic auth credentials in log output

CVE-2024-36127

apko Exposure of HTTP basic auth credentials in log output PUBLISHED

Description (CNA)

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.

Affected (CNA)

Vendor / product	Versions
chainguard-dev / apko	affected < 0.14.5

CWE

CWE-522, CWE-532

References

https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01

ADP enrichment

CVE

No English description supplied.

https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01

CISA-ADP

No English description supplied.

No references supplied.