Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/cloudevents/sdk-go/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GoPublished

    Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

    CVE-2024-28110 · GHSA-5pf6-2qwx-pxm2

    Affected
    • Go github.com/cloudevents/sdk-go/v2 <= 2.15.1
    Fixed in
    2.15.2· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. The relevant code is here (also inline, emphasis added): <preif p.Client == nil { p.Client = http.DefaultClient } if p.roundTripper != nil { p.Client.Transport = p.roundTripper } </pre When the transport is populated with an authenticated transport such as: - oauth2.Transport - idtoken.NewClient(...).Transport ... then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact! Found and patched by: @tcnghia and @mattmoor Patches v.2.15.2

    Recommended action: Upgrade to 2.15.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →