CVE-2024-35183— wolfictl 安全漏洞
一分钟漏洞结论
影响对象
wolfi-dev wolfictl
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
wolfictl是Wolfictl开源的一个与 Wolfi 一起使用的命令行工具。 Wolfictl 0.16.10 之前版本存在安全漏洞，该漏洞源于GitHub 令牌可能会泄露到远程非 GitHub git 服务器。
可能的 ATT&CK 技术 1 AI
T1552 · Unsecured Credentials
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-35183 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
wolfictl leaks GitHub tokens to remote non-GitHub git servers
来源: CVE Program / CVE List V5
Vulnerability Description
wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than `github.com`. Most git-dependent functionality in wolfictl relies on its own `git` package, which contains centralized logic for implementing interactions with git repositories. Some of this functionality requires authentication in order to access private repositories. A central function `GetGitAuth` looks for a GitHub token in the environment variable `GITHUB_TOKEN` and returns it as an HTTP basic auth object to be used with the `github.com/go-git/go-git/v5` library. Most callers (direct or indirect) of `GetGitAuth` use the token to authenticate to github.com only; however, in some cases callers were passing this authentication without checking that the remote git repository was hosted on github.com. This behavior has existed in one form or another since commit 0d06e1578300327c212dda26a5ab31d09352b9d0 - committed January 25, 2023. This impacts anyone who ran the `wolfictl check update` commands with a Melange configuration that included a `git-checkout` directive step that referenced a git repository not hosted on github.com. This also impacts anyone who ran `wolfictl update <url>` with a remote URL outside of github.com. Additionally, these subcommands must have run with the `GITHUB_TOKEN` environment variable set to a valid GitHub token. Users should upgrade to version 0.16.10 to receive a patch.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
对外部实体的文件或目录可访问
来源: CVE Program / CVE List V5
Vulnerability Title
wolfictl 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
wolfictl是Wolfictl开源的一个与 Wolfi 一起使用的命令行工具。 Wolfictl 0.16.10 之前版本存在安全漏洞，该漏洞源于GitHub 令牌可能会泄露到远程非 GitHub git 服务器。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-35183 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-35183 的情报信息
请登录查看更多情报信息。
CVE-2024-35183 补丁与修复 (2)
CVE-2024-35183 厂商安全公告 (1)
-
https://github.com/wolfi-dev/wolfictl/security/advisories/GHSA-8fg7-hp93-qhvr x_refsource_CONFIRM
CVE-2024-35183 其他参考 (3)
IV. Related Vulnerabilities
V. Comments for CVE-2024-35183
暂无评论