CVE-2024-23840 — `goreleaser release --debug` shows secrets
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secr…
Published: 2024-01-30 · CVSS: 5.5 · CVSS 3.1
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7