GO-2022-0491
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go
Quick fix
GO-2022-0491 — github.com/edgexfoundry/app-functions-sdk-go/v2: upgrade to the fixed version with the command below.
go get github.com/edgexfoundry/app-functions-sdk-go/v2@v2.1.1Details
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for github.com/edgexfoundry/app-functions-sdk-go (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 2.1.1go get github.com/edgexfoundry/app-functions-sdk-go/v2@v2.1.10No fixed version published yet for github.com/edgexfoundry/device-sdk-go (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 2.1.1go get github.com/edgexfoundry/device-sdk-go/v2@v2.1.1