What is GHSA-36rh-ggpr-j3gj?

GHSA-36rh-ggpr-j3gj is a security advisory published by GitHub Security Advisories with Medium severity. Renovate vulnerable to Azure DevOps token leakage in logs

Why does GHSA-36rh-ggpr-j3gj have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-36rh-ggpr-j3gj?

GHSA-36rh-ggpr-j3gj affects 1 product, including: npm/renovate:\u003e= 19.180.0, \u003c 23.25.1.

GHSA-36rh-ggpr-j3gjMediumDisclosed before NVD

Renovate vulnerable to Azure DevOps token leakage in logs

Vendor

GitHub Security Advisories

Published

September 14, 2020

Last Modified

January 7, 2023

📋 Description

Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

Patches

Fixed in

Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.

🎯 Affected products1

npm/renovate:>= 19.180.0, < 23.25.1

🔗 References (2)

https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj
https://github.com/advisories/GHSA-36rh-ggpr-j3gj