-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic case of CWE-532, Insertion of Sensitive Information into Log File. The analysis of the provided patches confirms that the run function in initializer/main.go was logging a variable resp that contained sensitive workload secrets. The patch removes this logging statement and replaces it with a generic message, thus mitigating the vulnerability. The function main.run is the direct source of the information leak and would appear in a runtime profile when the vulnerable code is executed. The vulnerability was a regression, meaning a previous fix was not correctly ported, and the provided commits re-apply the necessary changes to prevent the secret leakage.
GoGoOngoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/edgelesssys/contrast | go | >= 1.9.0, <= 1.12.1 | 1.12.2 |