CVE-2022-29810 (published 2022-04-27T06:15Z)

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/hashicorp/go-getter
commit_details: repo_url: https://github.com/hashicorp/go-getter
author: Guilherme Macedo
author_date: 2022-01-03 11:22:04+01:00
msg: Redact SSH key from URL query parameter

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>
repository: repo_url: https://github.com/hashicorp/go-getter
repo_name: hashicorp/go-getter
description: Package for downloading things from a string URL using a variety of protocols.
repo_language: Go
owner: hashicorp
file_changes: filename: .gitignore
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+cmd/go-getter/go-getter

programming_language: Batchfile
filename: url.go
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,12 @@ func RedactURL(u *url.URL) string {
 
 	ru := *u
 	if _, has := ru.User.Password(); has {
-		ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
+		ru.User = url.UserPassword(ru.User.Username(), "redacted")
+	}
+	q := ru.Query()
+	if q.Get("sshkey") != "" {
+		q.Set("sshkey", "redacted")
+		ru.RawQuery = q.Encode()
 	}
 	return ru.String()
 }

programming_language: Go
filename: url_test.go
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,7 @@ func TestRedactURL(t *testing.T) {
 				Path:   "this:that",
 				User:   url.UserPassword("user", "password"),
 			},
-			want: "http://user:xxxxx@host.tld/this:that",
+			want: "http://user:redacted@host.tld/this:that",
 		},
 		{
 			name: "blank Password",
@@ -39,7 +39,7 @@ func TestRedactURL(t *testing.T) {
 				Path:   "this:that",
 				User:   url.UserPassword("", "password"),
 			},
-			want: "http://:xxxxx@host.tld/this:that",
+			want: "http://:redacted@host.tld/this:that",
 		},
 		{
 			name: "blank Username, blank Password",
@@ -60,6 +60,28 @@ func TestRedactURL(t *testing.T) {
 			url:  nil,
 			want: "",
 		},
+		{
+			name: "non-blank SSH key in URL query parameter",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey=LS0tLS1CRUdJTiBPUE",
+			},
+			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=redacted",
+		},
+		{
+			name: "blank SSH key in URL query parameter",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey=",
+			},
+			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=",
+		},
 	}
 
 	for _, tt := range cases {

programming_language: Go