Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output

NIEDRIG 2.0GHSA-j5vm-7qcc-2wwg · GO-2024-2703 · Published 10/04/2024 · updated 10/09/2026

Kurz gesagt

GHSA-j5vm-7qcc-2wwg ist eine Schwachstelle (NIEDRIG (CVSS 2.0)) in github.com/kopia/kopia.
Abhilfe: auf 0.16.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/kopia/kopia Go	`< 0.16.0`	`0.16.0`

What kind of vulnerability is it? Who is impacted?

Storage credentials are written to the console.

Has the problem been patched? Yes, see #3589 What versions should users upgrade to?

Is there a way for users to fix or remediate the vulnerability without upgrading?

Be aware that kopia repo status --json will write the credentials to the output without scrubbing them.
Avoid executing kopia repo status with the --json flag in an insecure environment where.
Avoid logging the output of the kopia repo status --json command.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 0.16.0

0.16.0

Description

What kind of vulnerability is it? Who is impacted?

Storage credentials are written to the console.

Has the problem been patched? Yes, see #3589 What versions should users upgrade to?

Is there a way for users to fix or remediate the vulnerability without upgrading?

Be aware that kopia repo status --json will write the credentials to the output without scrubbing them.
Avoid executing kopia repo status with the --json flag in an insecure environment where.
Avoid logging the output of the kopia repo status --json command.

Weitere Schwachstellen in github.com/kopia/kopia

Alle anzeigen →