Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output

BAJO 2.0GHSA-j5vm-7qcc-2wwg · GO-2024-2703 · Published 10/04/2024 · updated 10/09/2026

En resumen

GHSA-j5vm-7qcc-2wwg es una vulnerabilidad BAJO (CVSS 2.0) que afecta a github.com/kopia/kopia.
Solución: actualizar a 0.16.0 o posterior.

Package	Affected versions	Patched versions
github.com/kopia/kopia Go	`< 0.16.0`	`0.16.0`

What kind of vulnerability is it? Who is impacted?

Storage credentials are written to the console.

Has the problem been patched? Yes, see #3589 What versions should users upgrade to?

Is there a way for users to fix or remediate the vulnerability without upgrading?

Be aware that kopia repo status --json will write the credentials to the output without scrubbing them.
Avoid executing kopia repo status with the --json flag in an insecure environment where.
Avoid logging the output of the kopia repo status --json command.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 0.16.0

0.16.0

Description

What kind of vulnerability is it? Who is impacted?

Storage credentials are written to the console.

Has the problem been patched? Yes, see #3589 What versions should users upgrade to?

Is there a way for users to fix or remediate the vulnerability without upgrading?

Be aware that kopia repo status --json will write the credentials to the output without scrubbing them.
Avoid executing kopia repo status with the --json flag in an insecure environment where.
Avoid logging the output of the kopia repo status --json command.

Más vulnerabilidades de github.com/kopia/kopia

Ver todo →