CVE-2024-36127

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-36127

Severity

7.5

High

CVSS V3

Summary

apko Exposure of HTTP basic auth credentials in log output

Description

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.

References

https://images.chainguard.dev/security/CGA-c3f6-mvqp-x58g
https://github.com/advisories/GHSA-v6mg-7f7p-qmqp
https://images.chainguard.dev/security/CGA-29r8-2q5f-v7hr
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36127.json
https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01
https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp
https://nvd.nist.gov/vuln/detail/CVE-2024-36127

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CVE-2024-36127

Severity

Summary

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company