`goreleaser release --debug` shows secrets
Date: 2024-01
Affected: go/github.com/goreleaser/goreleaser
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-23840
CWE: CWE-532
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

### Summary Hello 👋 `goreleaser release --debug` log shows secret values used in the in the custom publisher. How to reproduce the issue: - Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env` ``` #.goreleaser.yml publishers: - name: my-publisher # IDs of the artifacts we want to sign ids: - linux_archives - linux_package cmd: "./build/package/linux_notarize.sh" env: - VERSION={{ .Version }} - SECRET_1={{.Env.SECRET_1}} - SECRET_2={{.Env.SECRET_2}} ``` - run `goreleaser release --debug` You should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN` Example: ``` running cmd= .... SECRET_1=secret_value ```


Mitigations:

Architectural layers (MAESTRO):