{"action":"Upgrade github.com/anchore/syft to 0.70.0 or later.","affected":[{"fixed":"0.70.0","introduced":"0.69.0"}],"component":"github.com/anchore/syft","cve_ids":["CVE-2023-24827"],"ecosystem":"Go","epss":0.00791,"exploited":false,"fixed_versions":["0.70.0"],"ghsa_id":"GHSA-jp7v-3587-2956","id":"tcs_01M5KFYG9CH8EM5YYYPCN2ATX7","modified_at":"2026-03-03T04:53:15.609228Z","published_at":"2024-08-20T20:26:01Z","references":["https://osv.dev/vulnerability/GO-2023-1533","https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956","https://nvd.nist.gov/vuln/detail/CVE-2023-24827","https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2023-1533","url":"https://osv.dev/vulnerability/GO-2023-1533"}],"summary":"Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in github.com/anchore/syft"}