CVE-2024-6104: go-retryablehttp can leak basic auth credentials to log files

Modified

AliasesSUSE-SU-2024:2273-1SUSE-SU-2024:2273-2SUSE-SU-2024:2286-1+331 more

Published 24-06-2024Last modified 01-08-2024

Vulnerability summary

CVE-2024-6104 is a medium (CVSS 6.0) vulnerability in hashicorp retryablehttp. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.0/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.36%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 44 · Related 168

MGASA-2024-0343 OPENSUSE-SU-2024:14257-1 OPENSUSE-SU-2024:14258-1 OPENSUSE-SU-2025:14663-1 OPENSUSE-SU-2025:14988-1 OPENSUSE-SU-2025:14990-1+94 more

Showing 100 of 181.

Timeline

24-06-2024
PublishedVulnerability first disclosed.
01-08-2024
Last modifiedVulnerability information updated.

Description

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

CVSS metrics

7 scores · 7 sources · 1 version

v3.16.0

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard160 products

aactl< 0.4.12-r14
actions-runner-controller< 0.9.2-r2
actions-runner-controller-compat< 0.9.2-r2
actions-runner-controller-fips< 0.9.3-r0
actions-runner-controller-fips-compat< 0.9.3-r0

argo-cd-2.11< 2.11.3-r1
argo-events< 1.9.2-r1
argo-events-fips< 1.9.2-r1
atlantis-fips< 0.28.3-r1
bank-vaults< 1.20.4-r16
bank-vaults-fips< 1.20.4-r13
bank-vaults-template< 1.20.4-r16
bank-vaults-template-fips< 1.20.4-r13
buildctl< 0.14.1-r1
buildkitd< 0.14.1-r1
chainctl< 0.2.59-r0
consul-1.18< 1.18.2-r33
consul-1.18-oci-entrypoint< 1.18.2-r33
consul-1.18-oci-entrypoint-compat< 1.18.2-r33
cosign< 2.2.4-r7
cosign-fips< 2.2.4-r5
crossplane-provider-azure< 1.1.0-r4
crossplane-provider-azure-authorization< 1.1.0-r4
crossplane-provider-azure-authorization-compat< 1.1.0-r4
crossplane-provider-azure-managedidentity< 1.1.0-r4
crossplane-provider-azure-managedidentity-compat< 1.1.0-r4
crossplane-provider-azure-sql< 1.1.0-r4
crossplane-provider-azure-sql-compat< 1.1.0-r4
crossplane-provider-azure-storage< 1.1.0-r4
crossplane-provider-azure-storage-compat< 1.1.0-r4
crossplane-provider-family-azure< 1.1.0-r4
crossplane-provider-family-azure-compat< 1.1.0-r4
docker-credential-cgr< 0.2.59-r0
falcoctl< 0.8.0-r3
falcoctl-fips< 0.8.0-r3
flux< 2.3.0-r3
flux-helm-controller< 1.0.1-r3
flux-helm-controller-iamguarded-compat< 1.0.1-r3
flux-image-automation-controller< 0.38.0-r4
flux-image-automation-controller-compat< 0.38.0-r4
flux-image-automation-controller-iamguarded-compat< 0.38.0-r4
flux-image-reflector-controller< 0.32.0-r4
flux-image-reflector-controller-iamguarded-compat< 0.32.0-r4
flux-kustomize-controller< 1.3.0-r5
flux-kustomize-controller-iamguarded-compat< 1.3.0-r5
flux-notification-controller< 1.3.0-r4
flux-notification-controller-iamguarded-compat< 1.3.0-r4
flux-source-controller< 1.3.0-r4
flux-source-controller-iamguarded-compat< 1.3.0-r4
fulcio< 1.4.5-r5
fulcio-fips< 1.4.5-r6
gh< 2.52.0-r1
gh-doc< 2.52.0-r1
gitsign< 0.10.2-r3
gitsign-config< 0.10.2-r3
gitsign-credential-cache< 0.10.2-r3
glab< 1.42.0-r0
gomplate< 4.0.0-r0
gomplate-fips< 4.0.0-r0
goreleaser< 2.0.1-r2
grafana-mimir< 2.12.0-r3
guac< 0.7.2-r3
guaccsub< 0.7.2-r3
guacgql< 0.7.2-r3
guacingest< 0.7.2-r3
guacone< 0.7.2-r3
k3d< 5.6.3-r4
k3d-proxy< 5.6.3-r4
k3d-tools< 5.6.3-r4
k3s< 1.30.1-r2
k3s-multicall< 1.30.1-r2
k3s-static< 1.30.1-r2
kargo< 0.7.1-r1
kargo-oci-compat< 0.7.1-r1
ksops< 4.3.1-r5
ksops-compat< 4.3.1-r5
kubernetes-event-exporter< 1.7-r9
kubernetes-event-exporter-iamguarded-compat< 1.7-r9
kubescape< 3.0.11-r2
kubevela< 1.9.11-r5
kubevela-vela-cli< 1.9.11-r5
kubevela-vela-core< 1.9.11-r5
kubevela-vela-core-compat< 1.9.11-r5
loki-2.9< 2.9.8-r4
loki-2.9-logcli< 2.9.8-r4
loki-2.9-loki-canary< 2.9.8-r4
loki-2.9-promtail< 2.9.8-r4
neuvector-sigstore-interface< 0_git20240605-r0
neuvector-sigstore-interface-fips< 0_git20240605-r0
nuclei< 3.2.9-r1
opentelemetry-collector< 0.105.0-r0
opentelemetry-collector-compat< 0.105.0-r0
opentelemetry-collector-contrib< 0.103.0-r1
opentelemetry-collector-contrib-compat< 0.103.0-r1
opentelemetry-collector-contrib-fips< 0.102.0-r2
opentelemetry-collector-fips< 0.105.0-r0
opentelemetry-collector-ocb< 0.105.0-r0
opentelemetry-collector-ocb-fips< 0.105.0-r0
policy-controller< 0.9.0-r5
policy-controller-fips< 0.9.0-r7
policy-controller-tester< 0.9.0-r5
policy-controller-tester-fips< 0.9.0-r7
prometheus-2.51< 2.51.2-r48
prometheus-2.53< 2.53.0-r2
pulumi< 3.121.0-r1
pulumi-kubernetes-operator< 1.15.0-r6
pulumi-language-go< 3.121.0-r1
pulumi-language-nodejs< 3.121.0-r1
pulumi-language-python< 3.121.0-r1
rabbitmq-messaging-topology-operator< 1.14.2-r1
rabbitmq-messaging-topology-operator-compat< 1.14.2-r1
rabbitmq-messaging-topology-operator-iamguarded-compat< 1.14.2-r1
rekor< 1.3.6-r6
rekor-backfill-index< 1.3.6-r6
rekor-cli< 1.3.6-r6
rekor-fips< 1.3.6-r7
rekor-fips-backfill-index< 1.3.6-r7
rekor-fips-cli< 1.3.6-r7
rekor-fips-server< 1.3.6-r7
rekor-server< 1.3.6-r6
rook< 1.14.7-r1
rook-oci-compat< 1.14.7-r1
scorecard< 4.13.1-r10
sigstore-scaffolding< 0.7.2-r0
sigstore-scaffolding-fips< 0.7.2-r0
skopeo< 1.15.1-r2
slsa-verifier< 2.5.1-r8
snyk-cli< 1.1291.1-r2
sops< 3.8.1-r10
spire-agent< 1.10.0-r1
spire-agent-fips< 1.10.0-r1
spire-oidc-discovery-provider< 1.10.0-r1
spire-oidc-discovery-provider-fips< 1.10.0-r1
spire-server< 1.10.0-r1
spire-server-fips< 1.10.0-r1
src-fingerprint< 0.19.0-r16
src-fingerprint-fips< 0.19.0-r2
step-ca< 0.26.2-r1
step-ca-fips< 0.26.2-r2
tekton-chains< 0.21.1-r2
tekton-chains-fips< 0.21.1-r2
terraform< 1.5.7-r13
terraform-local-provider-config< 1.5.7-r13
terraform-provider-azurerm< 3.109.0-r1
terragrunt< 0.59.5-r1
terragrunt-docs< 0.59.5-r1
timestamp-authority< 1.2.2-r10
timestamp-authority-cli< 1.2.2-r10
timestamp-authority-fips< 1.2.2-r10
timestamp-authority-fips-cli< 1.2.2-r10
timestamp-authority-fips-server< 1.2.2-r10
timestamp-authority-server< 1.2.2-r10
tkn< 0.37.0-r3
tkn-fips< 0.37.0-r3
vault-1.16< 1.16.3-r15
vault-1.16-compat< 1.16.3-r15
vault-csi-provider< 1.4.0-r15
vexctl< 0.2.6-r9
zarf< 0.35.0-r1
zot< 2.0.4-r7

Show all 160

Wolfi40 products

aactl< 0.4.12-r14
actions-runner-controller< 0.9.2-r2
actions-runner-controller-compat< 0.9.2-r2
argo-events< 1.9.2-r1
bank-vaults< 1.20.4-r16

Show all 40

2 vendors · 200 products · Showing 200 of 297

References

20 links

discuss.hashicorp.com/c/securityWEBVendor Advisory
www.suse.com/support/update/announcement/2024/suse-su-20242273-1/Advisory
bugzilla.suse.com/1227052REPORT
www.suse.com/security/cve/CVE-2024-6104WEB
www.suse.com/support/update/announcement/2024/suse-su-20242273-2/Advisory
www.suse.com/support/update/announcement/2024/suse-su-20242286-1/Advisory
www.suse.com/support/update/announcement/2024/suse-su-20243062-1/Advisory
lists.opensuse.org/archives/…Advisory
bugzilla.suse.com/1227035REPORT
lists.opensuse.org/archives/…Advisory

Show all 20 references

ubuntu.com/security/CVE-2024-6104REPORT
www.cve.org/CVERecord?id=CVE-2024-6104REPORT
discuss.hashicorp.com/t/…REPORTWEB
github.com/hashicorp/go-retryablehttp/pull/158REPORT
github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049aREPORTWEBFIX
security-tracker.debian.org/tracker/CVE-2024-6104Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6104.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-6104AdvisoryOval
github.com/hashicorp/go-retryablehttpPACKAGE
github.com/advisories/GHSA-v6v8-xj6m-xwqhAdvisory