CVE-2024-6104

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6104
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-6104.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-6104
Aliases
Downstream
AZL (16)
CGA (475)
CLEANSTART (3)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (7)
OESA (2)
openSUSE (13)
RHEA (1)
RHSA (11)
RLSA (1)
SUSE (28)
UBUNTU (1)
Related
ALSA (4)
openSUSE (13)
SUSE (28)
Published
2024-06-24T17:06:21Z
Modified
2026-08-27T18:27:27Z
Severity
  • 6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
go-retryablehttp can leak basic auth credentials to log files
Details

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Database specific 
{
    "cna_assigner":  "HashiCorp",
    "cwe_ids":  [
        "CWE-532"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6104.json"
}
References

Affected packages

Git / github.com/hashicorp/go-retryablehttp

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/go-retryablehttp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1542b31176d3973a6ecbc06c05a2d0df89b59afb
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:hashicorp:retryablehttp:*:*:*:*:*:go:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.7.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-6104.json"