CVE-2024-23840

    Dashboard / Vulnerabilities / CVE-2024-23840

    CVE-2024-23840

    Published: 30 Jan 2024Last Modified: 28 Oct 2026

    Summary: `goreleaser release --debug` shows secrets

    Details: GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23840.json, https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h, https://nvd.nist.gov/vuln/detail/CVE-2024-23840, https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3ec68fbf8c3a1b16ca0f69aeccfb93765685b643
    Fixed -d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0

    Affected versions

    1.23.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High