x/vulndb: potential Go vuln in github.com/runatlantis/atlantis: GHSA-gppm-hq3p-h4rp

[GoVulnBot]

Advisory GHSA-gppm-hq3p-h4rp references a vulnerability in the following Go modules:

Module
github.com/runatlantis/atlantis

Description:

Summary

Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.

Atlantis logs contains GitHub credentials (tokens ghs_...) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub.

When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization.

This was reported in https://github.com/runatl...

References:

• ADVISORY: GHSA-gppm-hq3p-h4rp
• ADVISORY: GHSA-gppm-hq3p-h4rp
• FIX: fix: dont log GitHub app token in logs runatlantis/atlantis#4667
• REPORT: Git credentials are exposed in atlantis logs  runatlantis/atlantis#4060
• WEB: https://github.com/runatlantis/atlantis/releases/tag/v0.30.0

Cross references:

• github.com/runatlantis/atlantis appears in 1 other report(s):
  • data/reports/GO-2022-0534.yaml (x/vulndb: potential Go vuln in github.com/runatlantis/atlantis/server/controllers/events: CVE-2022-24912 #534)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/runatlantis/atlantis
      versions:
        - fixed: 0.30.0
      vulnerable_at: 0.29.0
summary: Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis
ghsas:
    - GHSA-gppm-hq3p-h4rp
references:
    - advisory: https://github.com/advisories/GHSA-gppm-hq3p-h4rp
    - advisory: https://github.com/runatlantis/atlantis/security/advisories/GHSA-gppm-hq3p-h4rp
    - fix: https://github.com/runatlantis/atlantis/pull/4667
    - report: https://github.com/runatlantis/atlantis/issues/4060
    - web: https://github.com/runatlantis/atlantis/releases/tag/v0.30.0
source:
    id: GHSA-gppm-hq3p-h4rp
    created: 2024-11-08T20:01:18.335934548Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/626158 mentions this issue: data/reports: add 4 NEEDS_REVIEW reports