VDB
Sign up
—

GO-2023-1497

Leaked user credentials in github.com/sylabs/scs-library-client

Quick fix

GO-2023-1497 — github.com/sylabs/scs-library-client: upgrade to the fixed version with the command below.

go get github.com/sylabs/scs-library-client@v1.3.4

Details

When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/sylabs/scs-library-client
Introduced in: 0Fixed in: 1.3.4
Fixgo get github.com/sylabs/scs-library-client@v1.3.4
Go/github.com/sylabs/scs-library-client
Introduced in: 1.4.0Fixed in: 1.4.2
Fixgo get github.com/sylabs/scs-library-client@v1.4.2

References