Packages / renovate / Security

ModerateVulnerabilityGHSA-v7x3-7hw7-pcjgCVE-2019-25766Published 21 Oct 2019

Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

Your version

Affected releases · renovate

  • 19.x19.0.0 – 19.38.6Fixed in 19.38.7
  • 18.x and older13.87.0 – 18.30.6No fix, no longer updated

On 19.x, the newest line:

npm install renovate@19.38.7
Every release on a timeline
44.x

  1. Not affected

    44.0.0 – 44.190.0

    603 releases, latest

19.x

  1. Affected

    19.0.0 – 19.38.6

    161 releases

  2. Fixed

    19.38.7 – 19.239.11

    733 releases

18.x

  1. Affected

    18.0.0 – 18.30.6

    160 releases

17.x

  1. Affected

    17.0.0 – 17.16.5

    80 releases

16.x

  1. Affected

    16.0.0 – 16.13.10

    70 releases

15.x

  1. Affected

    15.0.0 – 15.17.1

    56 releases

14.x

  1. Affected

    14.0.0 – 14.59.4

    280 releases

13.x

  1. Not affected

    13.0.0 – 13.86.0

    432 releases

  2. Affected

    13.87.0 – 13.180.4

    385 releases

12256 stable releases of renovate, oldest to newest, one row per major.

What happens

Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

Workarounds

Disable Go Modules support.

References

Blog post: renovatebot.com/blog/go-modules-vulnerability-d…

For more information

If you have any questions or comments about this advisory: