CVE-2024-28110CWE-522

Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

High · published March 6, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2024-03-06T21:12Z
EPSS history
Timeline
  • 06 MAR 21:12Z
    Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials
    cvelistv5