Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions
概要
Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has been fixed in Dependency-Track 4.6.0. Instead of logging the entire API key, only the last 4 characters of the key will be logged. It is strongly recommended to check historic logs for occurrences of this behavior, and re-generating API keys in case of leakage.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web docs.dependencytrack.org
- web github.com