Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1mNm1tLTVmYzctM2czY84AA8GD

goreleaser shows environment by default

Summary

Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment.

PoC

Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete $GOPATH/pkg).
Make sure to have secrets set in the environment
Make sure to not have go mod tidy in a before hook
Run goreleaser release --clean
Go prints lots of go: downloading ... lines, which triggers the "if output not empty, log it" line, which includes the environment.

Impact

Credentials and tokens are leaked.

Permalink: https://github.com/advisories/GHSA-f6mm-5fc7-3g3c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mNm1tLTVmYzctM2czY84AA8GD
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 7 months ago
Updated: 7 months ago

CVSS Score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-f6mm-5fc7-3g3c
References:

Repository: https://github.com/goreleaser/goreleaser
Blast Radius: 21.9

Affected Packages

go:github.com/goreleaser/goreleaser

Dependent packages: 856
Dependent repositories: 3,422
Downloads:
Affected Version Ranges: = 1.26.0
Fixed in: 1.26.1
All affected versions:
All unaffected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.3.1, 0.3.2, 0.3.4, 0.3.5, 0.3.6, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.9, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.7.9, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.10.0, 0.11.0, 0.11.1, 0.12.0, 0.12.1, 0.12.2, 0.12.3, 0.13.0, 0.13.1, 0.13.2, 0.13.3, 0.13.4, 0.13.5, 0.13.6, 0.14.0, 0.15.0, 0.15.1, 0.16.0, 0.16.1, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4, 0.17.5, 0.17.6, 0.18.0, 0.18.1, 0.19.0, 0.20.0, 0.20.1, 0.20.2, 0.20.3, 0.20.4, 0.21.0, 0.21.1, 0.21.2, 0.21.3, 0.21.4, 0.21.5, 0.22.0, 0.22.1, 0.22.2, 0.23.0, 0.23.1, 0.24.0, 0.25.0, 0.26.0, 0.26.1, 0.27.0, 0.27.1, 0.27.2, 0.27.3, 0.27.4, 0.27.5, 0.28.0, 0.28.1, 0.28.2, 0.28.3, 0.28.4, 0.28.5, 0.28.6, 0.28.7, 0.28.8, 0.28.9, 0.30.0, 0.30.1, 0.30.2, 0.30.3, 0.30.4, 0.30.5, 0.31.0, 0.31.1, 0.32.0, 0.32.1, 0.32.2, 0.33.0, 0.33.1, 0.33.2, 0.34.0, 0.34.1, 0.34.2, 0.34.3, 0.34.4, 0.34.5, 0.35.0, 0.35.1, 0.35.2, 0.35.3, 0.35.4, 0.35.5, 0.35.6, 0.35.7, 0.36.0, 0.36.1, 0.37.0, 0.37.1, 0.37.2, 0.37.3, 0.37.4, 0.37.5, 0.37.6, 0.37.7, 0.37.8, 0.37.9, 0.37.10, 0.38.0, 0.39.0, 0.40.0, 0.40.1, 0.40.2, 0.40.3, 0.40.4, 0.40.5, 0.40.6, 0.41.0, 0.41.1, 0.42.0, 0.42.1, 0.42.2, 0.43.0, 0.44.0, 0.44.1, 0.44.2, 0.45.0, 0.45.1, 0.45.2, 0.45.3, 0.45.4, 0.45.5, 0.46.0, 0.46.1, 0.46.2, 0.46.3, 0.46.4, 0.47.0, 0.47.1, 0.48.0, 0.49.0, 0.49.1, 0.49.2, 0.49.3, 0.50.0, 0.50.1, 0.51.0, 0.52.0, 0.52.1, 0.52.2, 0.52.3, 0.53.0, 0.54.0, 0.54.1, 0.54.2, 0.54.3, 0.55.0, 0.55.1, 0.56.0, 0.57.0, 0.57.1, 0.57.2, 0.58.0, 0.58.1, 0.58.2, 0.58.3, 0.59.0, 0.59.1, 0.60.0, 0.61.0, 0.61.1, 0.61.2, 0.61.3, 0.62.0, 0.62.1, 0.62.2, 0.62.3, 0.62.4, 0.62.5, 0.62.6, 0.63.0, 0.63.1, 0.64.0, 0.65.0, 0.66.0, 0.66.1, 0.67.0, 0.68.0, 0.69.0, 0.70.0, 0.71.0, 0.71.1, 0.72.0, 0.73.0, 0.73.1, 0.73.2, 0.74.0, 0.75.0, 0.76.0, 0.76.1, 0.77.0, 0.77.1, 0.77.2, 0.78.0, 0.79.0, 0.79.1, 0.79.2, 0.80.0, 0.80.1, 0.80.2, 0.81.0, 0.81.1, 0.82.0, 0.82.1, 0.82.2, 0.83.0, 0.83.1, 0.83.2, 0.83.3, 0.84.0, 0.85.0, 0.85.1, 0.85.2, 0.85.3, 0.86.0, 0.86.1, 0.87.0, 0.88.0, 0.89.0, 0.90.0, 0.91.0, 0.91.1, 0.91.2, 0.92.0, 0.92.1, 0.93.0, 0.93.1, 0.93.2, 0.94.0, 0.95.0, 0.95.1, 0.95.2, 0.96.0, 0.97.0, 0.98.0, 0.99.0, 0.100.0, 0.101.0, 0.102.0, 0.103.0, 0.103.1, 0.104.0, 0.104.1, 0.104.2, 0.104.3, 0.105.0, 0.106.0, 0.107.0, 0.108.0, 0.109.0, 0.110.0, 0.111.0, 0.112.0, 0.112.1, 0.112.2, 0.113.0, 0.113.1, 0.114.0, 0.114.1, 0.115.0, 0.116.0, 0.117.0, 0.117.1, 0.117.2, 0.118.0, 0.118.1, 0.118.2, 0.119.0, 0.120.0, 0.120.1, 0.120.2, 0.120.3, 0.120.4, 0.120.5, 0.120.6, 0.120.7, 0.120.8, 0.121.0, 0.122.0, 0.123.0, 0.123.1, 0.123.2, 0.123.3, 0.124.0, 0.124.1, 0.125.0, 0.126.0, 0.127.0, 0.128.0, 0.129.0, 0.130.0, 0.130.1, 0.130.2, 0.131.0, 0.131.1, 0.132.0, 0.132.1, 0.133.0, 0.134.0, 0.135.0, 0.136.0, 0.137.0, 0.138.0, 0.139.0, 0.140.0, 0.140.1, 0.141.0, 0.142.0, 0.143.0, 0.144.0, 0.144.1, 0.145.0, 0.146.0, 0.147.0, 0.147.1, 0.147.2, 0.148.0, 0.149.0, 0.150.0, 0.150.1, 0.151.0, 0.151.1, 0.151.2, 0.152.0, 0.153.0, 0.154.0, 0.155.0, 0.155.1, 0.155.2, 0.156.0, 0.156.1, 0.156.2, 0.157.0, 0.158.0, 0.159.0, 0.160.0, 0.161.0, 0.161.1, 0.162.0, 0.162.1, 0.163.0, 0.163.1, 0.164.0, 0.165.0, 0.166.0, 0.166.1, 0.166.2, 0.167.0, 0.168.0, 0.168.1, 0.168.2, 0.169.0, 0.170.0, 0.171.0, 0.172.0, 0.172.1, 0.173.0, 0.173.1, 0.173.2, 0.174.0, 0.174.1, 0.174.2, 0.175.0, 0.176.0, 0.177.0, 0.178.0, 0.179.0, 0.180.0, 0.180.1, 0.180.2, 0.180.3, 0.181.0, 0.181.1, 0.182.0, 0.182.1, 0.183.0, 0.184.0, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.9.0, 1.9.1, 1.9.2, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.11.5, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.13.0, 1.13.1, 1.14.0, 1.14.1, 1.15.0, 1.15.1, 1.15.2, 1.16.0, 1.16.1, 1.16.2, 1.17.0, 1.17.1, 1.17.2, 1.18.0, 1.18.1, 1.18.2, 1.19.0, 1.19.1, 1.19.2, 1.20.0, 1.21.0, 1.21.1, 1.21.2, 1.22.0, 1.22.1, 1.23.0, 1.24.0, 1.25.0, 1.25.1, 1.26.0, 1.26.1, 1.26.2