{"action":"Upgrade github.com/anchore/syft to 0.70.0 or later.","affected":[{"fixed":"0.70.0","introduced":"0.69.0"}],"component":"github.com/anchore/syft","cve_ids":["CVE-2023-24827"],"ecosystem":"Go","epss":0.00791,"exploited":false,"fixed_versions":["0.70.0"],"ghsa_id":"GHSA-jp7v-3587-2956","id":"tcs_01M5KFEHDQP8RYG4AVJCNDRED7","modified_at":"2024-08-20T20:58:55.980773Z","published_at":"2023-02-08T21:38:46Z","references":["https://osv.dev/vulnerability/GHSA-jp7v-3587-2956","https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956","https://nvd.nist.gov/vuln/detail/CVE-2023-24827","https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3","https://github.com/anchore/syft"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-jp7v-3587-2956","url":"https://osv.dev/vulnerability/GHSA-jp7v-3587-2956"}],"summary":"Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set"}