Executive brief
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
Affected products
- Go chainguard.dev/apko
Junglewise Threat Intelligence
CVE-2024-36127: GO-2024-2899 - apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
CVE-2024-36127 · Severity: low · CVSS 3.1 · Published 2024-06-14
Technologies: chainguard.dev/apko (Go). Vendors: Go.
Related threats
- melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to versi
- Chainguard apko denial of service via incorrect type assertion in DiscoverKeys
- Chainguard apko insufficient integrity check for apk packages
- Chainguard apko path traversal via symlink following in DirFS
- GO-2026-4410 - apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko