CVE-2024-40636: Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error

Quick answers

Is CVE-2024-40636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-40636 being exploited in the wild.

How severe is CVE-2024-40636?

Low severity, with a CVSS score of 3.1, published 17 July 2024.

Which products and versions are affected?

Steeltoe.Discovery.ClientAutofac (NuGet) ECOSYSTEM:introduced=0,last_affected=2.5.5; Steeltoe.Discovery.ClientCore (NuGet) ECOSYSTEM:introduced=0; Steeltoe.Discovery.Eureka (NuGet) ECOSYSTEM:introduced=0,fixed=3.2.8; Steeltoe.Discovery.EurekaBase (NuGet) ECOSYSTEM:introduced=0,last_affected=2.5.5.

Is there a fix for CVE-2024-40636?

Yes. Steeltoe.Discovery.Eureka (NuGet): upgrade to 3.2.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2024-40636?

Check whether you run Steeltoe.Discovery.ClientAutofac (NuGet), Steeltoe.Discovery.ClientCore (NuGet), Steeltoe.Discovery.Eureka (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• Steeltoe.Discovery.Eureka (NuGet): upgrade to 3.2.8 or later

  dotnet add package Steeltoe.Discovery.Eureka --version 3.2.8

Affected products

• Steeltoe.Discovery.ClientAutofac (NuGet) ECOSYSTEM:introduced=0,last_affected=2.5.5
• Steeltoe.Discovery.ClientCore (NuGet) ECOSYSTEM:introduced=0
• Steeltoe.Discovery.Eureka (NuGet) ECOSYSTEM:introduced=0,fixed=3.2.8
• Steeltoe.Discovery.EurekaBase (NuGet) ECOSYSTEM:introduced=0,last_affected=2.5.5

Identifiers

• CVE-2024-40636
• GHSA-vmcp-66r5-3pcp