CVE-2024-6104: go-retryablehttp can leak basic auth credentials to log files

go-retryablehttp could allow a local authenticated attacker to obtain sensitive information, caused by the failure to sanitize urls when writing them to its log file. An attacker could exploit this vulnerability to write sensitive HTTP basic auth credentials to its log file.

— IBM

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

— GitHub