Packages / renovate / Security

ModerateVulnerabilityGHSA-36rh-ggpr-j3gjCVE-2020-37267Published 14 Sep 2020

Renovate vulnerable to Azure DevOps token leakage in logs

Your version

Affected releases · renovate

  • 23.x23.0.0 – 23.25.0Fixed in 23.25.1
  • 22.x and older19.180.0 – 22.25.6No fix, no longer updated

On 23.x, the newest line:

npm install renovate@23.25.1
Every release on a timeline
44.x

  1. Not affected

    44.0.0 – 44.190.0

    603 releases, latest

23.x

  1. Affected

    23.0.0 – 23.25.0

    68 releases

  2. Fixed

    23.25.1 – 23.100.5

    219 releases

22.x

  1. Affected

    22.0.3 – 22.25.6

    89 releases

21.x

  1. Affected

    21.0.0 – 21.33.15

    130 releases

20.x

  1. Affected

    20.0.0 – 20.25.8

    67 releases

19.x

  1. Not affected

    19.0.0 – 19.179.0

    678 releases

  2. Affected

    19.180.0 – 19.239.11

    216 releases

12256 stable releases of renovate, oldest to newest, one row per major.

What happens

Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

Patches

Fixed in

Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.