Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output

低 2.0GHSA-j5vm-7qcc-2wwg · GO-2024-2703 · 10/04/2024 公開 · 10/09/2026 更新

要点

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/kopia/kopia Go	`< 0.16.0`	`0.16.0`

What kind of vulnerability is it? Who is impacted?

Storage credentials are written to the console.

Has the problem been patched? Yes, see #3589 What versions should users upgrade to?

Is there a way for users to fix or remediate the vulnerability without upgrading?

Be aware that kopia repo status --json will write the credentials to the output without scrubbing them.
Avoid executing kopia repo status with the --json flag in an insecure environment where.
Avoid logging the output of the kopia repo status --json command.

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

< 0.16.0

0.16.0

概要

What kind of vulnerability is it? Who is impacted?

Storage credentials are written to the console.

Has the problem been patched? Yes, see #3589 What versions should users upgrade to?

Is there a way for users to fix or remediate the vulnerability without upgrading?

Be aware that kopia repo status --json will write the credentials to the output without scrubbing them.
Avoid executing kopia repo status with the --json flag in an insecure environment where.
Avoid logging the output of the kopia repo status --json command.

github.com/kopia/kopia のその他の脆弱性

すべて見る →