CVE-2019-25766: Renovate before 19.38.7 Credential Exposure via Go Modules
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 19.38.7
Event History
Frequently Asked Questions
Which environments are exposed?
Renovate installations running versions 13.87.0 through 19.38.6 are affected when a Go Modules dependency update encounters the relevant failure scenario. Exposure is limited to cases where temporary repository tokens are written into pull request comments.
Who could obtain an exposed token?
Anyone with permission to view the affected pull request comments could obtain the temporary repository tokens. No additional privileges are described as necessary beyond access to those comments.
What should teams do if they cannot patch immediately?
Review pull request comments created by affected Renovate versions for Go Modules update failures and restrict access to those comments where possible. Treat any token found in an affected comment as exposed and replace it.
How can I determine whether tokens may already have been exposed?
Check whether Renovate ran a version from 13.87.0 through 19.38.6 and produced pull request comments during failed Go Modules updates. Inspect those comments for temporary repository tokens.
What version fixes the issue?
Upgrade Renovate to version 19.38.7, which fixes the credential exposure.