Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/huandu/facebook/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.7GoPublished

    github.com/huandu/facebook may expose access_token in error message.

    CVE-2024-35232 · GHSA-3f65-m234-9mxr

    Affected
    • Go github.com/huandu/facebook/v2 <= 2.7.1
    Fixed in
    2.7.2· Vendor fix available
    Issue
    accesstoken can be exposed in error message on fail in HTTP request. Details Using this module, when HTTP request fails, error message can contain accesstoken. This can be happen when: - module is sending HTTP request with query parameter ?accesstoken=.... - and HTTP request fails (errors like facebook: cannot reach facebook server). In such situation, error message is constucted like following. https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 Original error message contained in it comes from net/http module. And it can contain full URL, that can contain query parameter accesstoken: https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30 It should be very common that applications log error message when they encounter errors. As a result, accesstoken can be stored into log server and some other infrastructures. Of…

    Recommended action: Upgrade to 2.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →