goreleaser shows environment by default

中 6.2GHSA-f6mm-5fc7-3g3c · GO-2024-2860 · 15/05/2024 公開 · 10/09/2026 更新

要点

GHSA-f6mm-5fc7-3g3c は github.com/goreleaser/goreleaser に影響する深刻度「中」 (CVSS 6.2) の脆弱性です。
対処：1.26.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/goreleaser/goreleaser Go	`≥ 1.26.0, < 1.26.1`	`1.26.1`

概要

Summary

Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment.

PoC

Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete $GOPATH/pkg).
Make sure to have secrets set in the environment
Make sure to not have go mod tidy in a before hook
Run goreleaser release --clean
Go prints lots of go: downloading ... lines, which triggers the "if output not empty, log it" line, which includes the environment.

Impact

Credentials and tokens are leaked.

参考情報

goreleaser/goreleaser security advisory · WEB
goreleaser/goreleaser#4787 · WEB
goreleaser/goreleaser commit 22f734e · WEB
goreleaser/goreleaser · PACKAGE

github.com/goreleaser/goreleaser のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

github.com/goreleaser/goreleaser

≥ 1.26.0, < 1.26.1

1.26.1

概要

Summary

Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment.

PoC

Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete $GOPATH/pkg).
Make sure to have secrets set in the environment
Make sure to not have go mod tidy in a before hook
Run goreleaser release --clean
Go prints lots of go: downloading ... lines, which triggers the "if output not empty, log it" line, which includes the environment.

Impact

Credentials and tokens are leaked.