Vulnerability · Published Mar 19, 2020 · Assigned by GitHub_M

CVE-2020-5262GitHub personal access token leaking into temporary EasyBuild (debug) logs

High 7.7

In plain English

A high-severity sensitive data in logs in easybuild-framework from easybuilders. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	easybuild	4.1.2	PYSEC-2020-268
PyPI	easybuild-framework	4.1.2	GHSA-2wx6-wc87-rmjm
PyPI	easybuild-framework	4.1.2	PYSEC-2020-41

Affected products (as reported)

Vendor	Product	Versions
easybuilders	easybuild-framework	< 4.1.2

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/easybuilders/easybuild-framework/security/advisories/GHSA-2wx6-wc87-rmjm x_refsource_CONFIRM
https://github.com/easybuilders/easybuild-framework/pull/3248 x_refsource_MISC
https://github.com/easybuilders/easybuild-framework/pull/3249 x_refsource_MISC