CVE-2025-48374: zot logs secrets

The vulnerability (GHSA-c37v-3c8w-crq8 / CVE-2025-48374) describes the logging of OIDC client secrets. The provided commit 8a99a3ed231fdcd8467e986182b4705342b6a15e directly addresses this by modifying the Sanitize method within pkg/api/config/config.go. This method is designed to redact sensitive information from the application's configuration. The patch introduces specific logic to iterate over OIDC providers in the configuration and replace their ClientSecret field with a placeholder ('******').

The vulnerability occurred because, prior to this patch, the Sanitize method lacked this specific redaction step for OIDC client secrets, even though it handled other secrets like LDAP bind passwords. When the application logged its configuration (e.g., at startup), it likely used the output of this Sanitize method. Since the OIDC client secrets were not redacted by the then-current version of Sanitize, they were written to the logs.

Therefore, the config.(*Config).Sanitize method, in its state before the patch, is the function that failed to properly process and redact the sensitive OIDC client secret, directly leading to its exposure when the configuration was logged. This function would be active in the code path that prepares configuration for logging, and its failure to redact the secret is the root cause of the vulnerability.