| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/goharbor/harbor | ≥ 2.13.0, < 2.13.5≥ 2.14.0, < 2.14.3 | 2.13.52.14.3 |
Harbor write configuration payload to audit log when configuration change, the ldap_search_password and oidc_client_secret will be logged in the audit log without redacted
Harbor v2.15.0, v2.14.3, v2.13.5
Disable audit log configure event in Harbor Web Console: Go to Administration -> Configuration -> Enable Audit Log Event Type -> Uncheck "Update Configuration" and click "Save" Button.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free