CVE-2024-6104
Aliases:GHSA-v6v8-xj6m-xwqhGO-2024-2947DEBIAN-CVE-2024-6104CGA-2526-cwq8-j335CGA-254p-w5ff-5wfmCGA-25mw-p584-p9m8CGA-25q8-93w2-3843CGA-2752-54v7-gpj6CGA-279r-7jr6-9vhgCGA-2gh6-j8ch-g974CGA-2j5x-xf3p-448rCGA-2rf3-mxhv-fqc2CGA-2vmv-m64w-pr6jCGA-2w2r-724f-gjp6CGA-3533-55rw-5jcfCGA-385f-pgqh-8953CGA-39qm-2c5v-p7pjCGA-3c2x-54qq-56v4CGA-3cwr-6prj-w4v5CGA-3h4f-cf75-vhrfCGA-3mqf-34v3-wr8hCGA-3vvg-8x5p-2x59CGA-3xgf-6prr-p4vvCGA-426q-344h-6q2gCGA-43hg-2395-56v2CGA-4674-wq64-x5xpCGA-48gh-fxhg-8xw3CGA-49xh-5j37-7chmCGA-4fmg-vq7x-rrjhCGA-4h4f-vxvv-j648CGA-4hf9-258w-4pmqCGA-4j4x-pq8v-vvhjCGA-4j72-rg8w-h2g5CGA-4mch-hcpp-rhrqCGA-4p39-q8v7-6cmmCGA-4q93-39j8-62c5CGA-4v4h-ff8m-3cxcCGA-4v8f-8rxq-gqh7CGA-4wx9-6x49-qxq9CGA-4xw8-ff3f-mmvpCGA-527x-xqqm-jr5gCGA-55q6-gv4p-978hCGA-5849-rf5x-95v8CGA-58jv-4wcx-8q4wCGA-59h3-4937-rrg4CGA-5j4p-2fvc-38mvCGA-5mvp-6r4q-2m85CGA-5pcf-249h-vmjrCGA-5qh8-rc3m-987wCGA-5v5h-5x9f-3m4rCGA-64p7-92jp-mp2hCGA-6577-qhf7-7j78CGA-65mw-pw77-9hwcCGA-6828-c3qh-6wrfCGA-6859-vjx6-vx7gCGA-6jcw-hqrm-6675CGA-6m6g-cj6c-hm4jCGA-6m6x-fhrj-9j8mCGA-6mwm-vw3q-65qwCGA-6wh3-jpg6-6qrfCGA-6wqj-66jc-mp9pCGA-7253-9x2c-7765CGA-72r9-5gf7-378wCGA-7326-7mr9-2gm8CGA-745j-7r59-qpxcCGA-74pp-xjrh-3wjcCGA-7583-2vjw-w648CGA-7629-2q96-qwjfCGA-782c-v68j-fpw4CGA-785m-4cp6-722vCGA-797r-c7wq-pp5gCGA-7c56-p2mq-4vhqCGA-7cjx-gh2p-8qhgCGA-7h3w-8vg3-2vgrCGA-7m88-8fmx-j6r6CGA-7mw9-2gc2-hfhxCGA-7pwm-rqrx-pv3fCGA-7vgr-5v8f-g4cfCGA-8882-r2v8-6wggCGA-88v3-4c2r-p78wCGA-88w8-hghv-ggj6CGA-8f3h-9mfq-2g4pCGA-8j28-g6cv-rrv6CGA-8p36-5hg7-6wh8CGA-8qq2-r763-rhx8CGA-8rj6-rg42-x42xCGA-8rwv-h4p4-7x3fCGA-8vr8-hm98-hm8rCGA-8x9q-j79x-xpgrCGA-93ph-r425-jf5wCGA-962f-pc8h-8wwpCGA-966v-5f5q-pvjmCGA-96hc-vqxq-h832CGA-97v4-44c5-h7mfCGA-982p-4595-cfhpCGA-98p3-3w58-g7rhCGA-99j9-x827-3jr5CGA-9g7m-8wwc-m6qgCGA-9jv9-g9p7-w829CGA-9jxc-j7ph-95c5CGA-9qf5-qp79-x7wpCGA-c25f-q3g3-72vwCGA-c27v-82hf-mq52CGA-c3gr-6cp9-xrfxCGA-c5fj-9phm-gf6fCGA-c8jr-43xp-hc2xCGA-cf73-4m5m-vv64CGA-ch3j-grvq-r9rfCGA-cjm7-h5q4-rq47CGA-cq4c-q8rj-5p98CGA-cq9f-f2p3-xx29CGA-cx52-h7h8-c554CGA-cxm5-gcc6-fvf6CGA-f396-2h78-crg9CGA-f3rf-fqf8-4835CGA-f3v9-h324-cpf3CGA-f584-87q4-p7g2CGA-f7v8-w5h8-hcf5CGA-f89f-49xx-r36qCGA-f89p-5qrv-q4x9CGA-fc64-q79p-c2xvCGA-ff32-45rv-c5c7CGA-fgq2-5ff4-vw2cCGA-fgw4-r4xp-qmxxCGA-fjcm-9qmm-qj7pCGA-fm32-37jr-r247CGA-fm9p-qx7v-7hqrCGA-fp44-8rr6-jrghCGA-fpq4-h4r3-9jq9CGA-fqvq-wmgc-v4h2CGA-fw72-r9p3-hrhrCGA-fwqm-cvxq-4vc2CGA-fxhv-mg36-295hCGA-g4pv-rf83-858fCGA-g5cx-qq77-fm3mCGA-g76w-v6hx-vgpfCGA-g7vc-xwpp-jqxgCGA-g8cj-h24j-q9cqCGA-g9hv-w47r-qx3pCGA-ghj7-rvvr-x7w8CGA-gm2j-r7wx-rw3cCGA-gm5p-jv26-9xpfCGA-gpf9-4mhw-r644CGA-gq3r-vj46-vghmCGA-h3cv-3549-jwc7CGA-h69g-5g87-7xh9CGA-h77w-x4gm-rgm6CGA-h7qf-rrq2-v5w2CGA-hc88-jx8m-6h65CGA-hq4f-h3fh-jr5qCGA-hrf6-j258-hw38CGA-hw55-6r6m-9w8jCGA-hxvq-j99f-48gxCGA-j2r6-wpc3-7543CGA-j7pc-wwwq-j83qCGA-j8gf-5mjx-9qmrCGA-j8p6-3mqp-m5chCGA-jfg8-h8x4-c45rCGA-jjj8-c4hw-5gv7CGA-jvmq-v36m-5pjxCGA-jw42-vmv2-8fq3CGA-jwcr-73mp-h88cCGA-jwp2-83qc-627qCGA-m3j6-w87r-8m3wCGA-m3jr-5pvv-9j26CGA-m63j-3wx2-v9fwCGA-m7x2-4mfr-jmprCGA-m84h-8wx7-rm8wCGA-mm4m-4cqm-x86wCGA-mqpg-gp6g-2p7rCGA-mw2m-2rw8-3pvpCGA-mxvq-2p7w-whg7CGA-p49j-5hjh-pg9gCGA-p4r2-8cvr-46gvCGA-p575-v4mg-qqj7CGA-p82m-qfqw-rp7mCGA-pgwx-qv5w-3pqvCGA-phjc-9fv4-c7q9CGA-ppf4-v6r8-cv6fCGA-pwm4-25qg-22r8CGA-px23-f9cr-4rxmCGA-2235-mxf9-hhvgCGA-24x5-46qr-vcrrCGA-265c-mc6c-9rp5CGA-27w5-cgm2-9hgmCGA-2cwf-jx4v-9x7qCGA-2g3g-r2hx-q3g3CGA-2g44-7rj4-j696CGA-3823-2f56-hx8cCGA-38m7-p7mm-9m62CGA-39mr-7753-hfgfCGA-3frr-xv48-gjwgCGA-3gr5-3x2x-mq8pCGA-43gx-xrh8-69mwCGA-45gc-qxvp-rpjqCGA-4f8j-8ff9-9chfCGA-4g35-4fqq-4r2jCGA-4rr6-3mj8-qqxvCGA-52qv-j4wp-3j69CGA-58mf-q8wp-g8fcCGA-5c79-rg8f-hwmpCGA-5ch9-p7ph-65m4CGA-5f4v-xjfw-rrr9CGA-5j3c-gvcc-xjrfCGA-5jpg-f6mc-hf99CGA-5pq4-x4pv-j6xpCGA-5q39-9mwx-h787CGA-5w47-vgmq-q533CGA-5wqp-f9g2-v4r8CGA-64gf-x349-mx75CGA-6657-2w5j-c298CGA-6m69-mcw2-rgmwCGA-6r3q-633m-6cr3CGA-6x55-74p4-2p44CGA-7wvq-vf4f-4mpqCGA-88mr-x8mv-955rCGA-8cfw-pcwf-ppvwCGA-8f67-vrwc-hqh7CGA-8fj9-ggvv-2wxqCGA-8h7h-83r4-4cr3CGA-8pcv-h85g-wx52CGA-c367-7pvh-ghwhCGA-c5qc-844j-8jrxCGA-c956-hrxq-rpphCGA-c963-xvw7-xqhcCGA-f65w-8qpj-v49gCGA-ffh4-9x83-vvjqCGA-fq2g-hc6p-f838CGA-fr54-mqqx-3p96CGA-gvgc-xqrm-rf4wCGA-gvhm-93gj-425gCGA-h7p8-29m4-rhg2CGA-hqqv-v73v-245jCGA-hvj3-4492-4pr4CGA-j3f5-w4hp-x4h5CGA-j3hf-xw35-hcj6CGA-jc59-pg9c-2hf8CGA-jcrw-7p85-7vmqCGA-jh58-5f3j-qp73CGA-jjw3-vjjf-22jhCGA-jp4f-v6cc-9r5qCGA-jpv4-vhhm-m3xxCGA-jvv7-83vf-vq92CGA-m55f-9mxp-pmq5CGA-mch3-xqh4-p4j3CGA-mcpf-4qr5-97gxCGA-mv9p-j8gc-69h4CGA-mvrf-8452-q5xcCGA-mxvc-x628-gp6wCGA-p5fm-qvfw-94p9CGA-p5r3-4q5f-g34rCGA-p735-6cw5-59ffCGA-p9x6-xh34-pggqCGA-q2hf-7qcj-h3h6CGA-q3p5-pv6f-8v2hCGA-q6rj-w8jm-87p8CGA-q8wv-cm8w-8pfhCGA-q973-wwx6-fxfrCGA-qj7r-fwrw-gv9rCGA-qpvg-cwgq-mwmcCGA-qqv9-796c-hcwpCGA-qrx3-f45f-p256CGA-qvvm-xm2j-qcpjCGA-qw33-mrmv-wc8pCGA-qw86-m326-35cwCGA-r3p6-m7m4-wf7mCGA-r3vf-2h5j-2q2gCGA-r3xq-mh96-jhf6CGA-r4c5-4jqq-hw64CGA-r5f9-959g-q29cCGA-r6vm-cxxp-7gqvCGA-r982-rp77-29vvCGA-r9f9-vmx2-pxp7CGA-rf34-7hc5-qpxrCGA-rfqf-xgj5-3f34CGA-rg9r-686m-36gcCGA-rgc7-hcww-jc62CGA-rhv6-xmjj-5xv3CGA-rjv2-6vhr-f37cCGA-rr66-jx6r-q8p8CGA-rxc9-6q7j-938qCGA-rxg9-2rh3-rm4gCGA-v3p3-r4v7-gh82CGA-v3pw-5cpg-59xqCGA-v7q3-f56x-j773CGA-v897-x2rj-xmw6CGA-vc62-j72w-mh6mCGA-vcvr-gjf5-39qmCGA-vgr7-h256-2xx7CGA-vhfm-p26c-36gvCGA-vjvp-vqvv-j9c7CGA-vjwq-g8j2-q5w3CGA-vmjg-6xqr-j34cCGA-vmr9-4h9w-642mCGA-vqc3-f6xv-h5fvCGA-vr2r-cmx4-4gqpCGA-vrcc-fmwc-jvfqCGA-vwjx-m5fp-gfx6CGA-w28p-7m5w-9gcmCGA-w2cr-8f29-4988CGA-w4h8-h7jq-657qCGA-w644-5r6r-qgg8CGA-w72f-8p2m-6pjhCGA-wmx3-6r7m-677pCGA-wqp2-gpqx-j24fCGA-wv5g-5rg6-8mmxCGA-wx36-v4pj-jq27CGA-x234-fq3p-r5c5CGA-x253-xmwm-6685CGA-x2w4-ffcm-x942CGA-x4wg-f5vc-865hCGA-x563-cwmm-2cwjCGA-x5jr-prr7-pg3cCGA-x958-5pvc-9528CGA-xccv-5wcc-vrfcCGA-xf8h-p3hm-g4g3CGA-xgjv-6q94-j78fCGA-xqcc-3w9m-cjpfCGA-xqmx-53cp-c3r8CGA-xvjh-j28g-3r52CGA-xvqv-wrhf-8g9pCGA-xwv9-72p6-6mhhCGA-xxj6-mrwf-4jj3
Advisory lineage Upstream: 0 Downstream: 56
Modified
Published: 24 Jun 2024, 17:06
Last modified:01 Aug 2024, 21:33
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
6 MEDIUM
v3.1 (cve.org)
EPSS Score
0.36% LOW
0% probability +0.31%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
24 Jun 2024, 17:06
Published
Vulnerability first disclosed
01 Aug 2024, 21:33
Last Modified
Vulnerability information updated
Description
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
CVSS Metrics
- v3.1•MEDIUM•Score: 6CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Trends
Current EPSS score: 0.36%• Percentile: 30%
Techniques & Countermeasures
- CWE-532•Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
Affected Systems
- chainguard•aactl
< 0.4.12-r14
- chainguard•actions-runner-controller
< 0.9.2-r2
- chainguard•actions-runner-controller-compat
< 0.9.2-r2
- chainguard•actions-runner-controller-fips
< 0.9.3-r0
- chainguard•actions-runner-controller-fips-compat
< 0.9.3-r0
- chainguard•argo-cd-2.11
< 2.11.3-r1
- chainguard•argo-events
< 1.9.2-r1
- chainguard•argo-events-fips
< 1.9.2-r1
- chainguard•atlantis-fips
< 0.28.3-r1
- chainguard•bank-vaults
< 1.20.4-r16
- chainguard•bank-vaults-fips
< 1.20.4-r13
- chainguard•bank-vaults-template
< 1.20.4-r16
- chainguard•bank-vaults-template-fips
< 1.20.4-r13
- chainguard•buildctl
< 0.14.1-r1
- chainguard•buildkitd
< 0.14.1-r1
- chainguard•chainctl
< 0.2.59-r0
- chainguard•consul-1.18
< 1.18.2-r33
- chainguard•consul-1.18-oci-entrypoint
< 1.18.2-r33
- chainguard•consul-1.18-oci-entrypoint-compat
< 1.18.2-r33
- chainguard•cosign
< 2.2.4-r7
- chainguard•cosign-fips
< 2.2.4-r5
- chainguard•crossplane-provider-azure
< 1.1.0-r4
- chainguard•crossplane-provider-azure-authorization
< 1.1.0-r4
- chainguard•crossplane-provider-azure-authorization-compat
< 1.1.0-r4
- chainguard•crossplane-provider-azure-managedidentity
< 1.1.0-r4
- chainguard•crossplane-provider-azure-managedidentity-compat
< 1.1.0-r4
- chainguard•crossplane-provider-azure-sql
< 1.1.0-r4
- chainguard•crossplane-provider-azure-sql-compat
< 1.1.0-r4
- chainguard•crossplane-provider-azure-storage
< 1.1.0-r4
- chainguard•crossplane-provider-azure-storage-compat
< 1.1.0-r4
- chainguard•crossplane-provider-family-azure
< 1.1.0-r4
- chainguard•crossplane-provider-family-azure-compat
< 1.1.0-r4
- chainguard•docker-credential-cgr
< 0.2.59-r0
- chainguard•falcoctl
< 0.8.0-r3
- chainguard•falcoctl-fips
< 0.8.0-r3
- chainguard•flux
< 2.3.0-r3
- chainguard•flux-helm-controller
< 1.0.1-r3
- chainguard•flux-helm-controller-iamguarded-compat
< 1.0.1-r3
- chainguard•flux-image-automation-controller
< 0.38.0-r4
- chainguard•flux-image-automation-controller-compat
< 0.38.0-r4
- chainguard•flux-image-automation-controller-iamguarded-compat
< 0.38.0-r4
- chainguard•flux-image-reflector-controller
< 0.32.0-r4
- chainguard•flux-image-reflector-controller-iamguarded-compat
< 0.32.0-r4
- chainguard•flux-kustomize-controller
< 1.3.0-r5
- chainguard•flux-kustomize-controller-iamguarded-compat
< 1.3.0-r5
- chainguard•flux-notification-controller
< 1.3.0-r4
- chainguard•flux-notification-controller-iamguarded-compat
< 1.3.0-r4
- chainguard•flux-source-controller
< 1.3.0-r4
- chainguard•flux-source-controller-iamguarded-compat
< 1.3.0-r4
- chainguard•fulcio
< 1.4.5-r5
Showing first 50 affected entries in server-rendered view.
References (8)
- https://discuss.hashicorp.com/c/security
- https://nvd.nist.gov/vuln/detail/CVE-2024-6104
- https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a
- https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027
- https://github.com/advisories/GHSA-v6v8-xj6m-xwqh
- https://github.com/hashicorp/go-retryablehttp
- https://security-tracker.debian.org/tracker/CVE-2024-6104
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6104.json