Go/github.com/anchore/syft CVE-2023-24827: medium 6.5, EPSS 0.79%
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set
Action: Upgrade github.com/anchore/syft to 0.70.0 or later.
go get github.com/anchore/syft@v0.70.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.69.0 | 0.70.0 | - |
Fixed versions
| 0.70.0 |
Sources
- osv: GHSA-jp7v-3587-2956
- https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956
- https://nvd.nist.gov/vuln/detail/CVE-2023-24827
- https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3
- https://github.com/anchore/syft
CVE-2023-24827 · published · modified · JSON