CVE-2020-37267: Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 23.25.1 - Operational
If Azure DevOps user logs (server or pipeline) may have been exposed, revoke and regenerate the bot credentials.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Azure DevOps users running Renovate versions 19.180.0 through versions before 23.25.1 are affected if Renovate output is saved in server or pipeline logs. Anyone able to access those saved logs could potentially obtain the bot authorization token.
What should be done if affected logs may have been accessible?
Upgrade Renovate to version 23.25.1 or later to prevent the token from being logged without redaction. Revoke and regenerate the Azure DevOps bot credentials if affected logs may have been exposed.