CVE-2024-23840
`goreleaser release --debug` shows secrets
Impact
### Summary Hello 👋 `goreleaser release --debug` log shows secret values used in the in the custom publisher. How to reproduce the issue: - Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env` ``` #.goreleaser.yml publishers: - name: my-publisher # IDs of the artifacts we want to sign ids: - linux_archives - linux_package cmd: "./build/package/linux_notarize.sh" env: - VERSION={{ .Version }} - SECRET_1={{.Env.SECRET_1}} - SECRET_2={{.Env.SECRET_2}} ``` - run `goreleaser release --debug` You should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN` Example: ``` running cmd= .... SECRET_1=secret_value ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/goreleaser/goreleaser | = 1.23.0 | 1.24.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Goreleaser | Goreleaser | Version 1.23.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0
- https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h
- https://github.com/advisories/GHSA-h3q2-8whx-c29h
- https://nvd.nist.gov/vuln/detail/CVE-2024-23840