Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-40636
July 17, 2024
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is `_logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.
Affected Packages
Steeltoe.Discovery.Eureka (NUGET):
Affected version(s) >=3.0.0-rc1 <3.2.8
Fix Suggestion:
Update to version 3.2.8
Steeltoe.Discovery.EurekaBase (NUGET):
Affected version(s) >=2.0.0 <3.0.0-m1
Fix Suggestion:
Update to version 3.0.0-m1
Steeltoe.Discovery.ClientCore (NUGET):
Affected version(s) >=2.0.0-rc1 <3.0.0-rc1
Fix Suggestion:
Update to version 3.0.0-rc1
Steeltoe.Discovery.ClientAutofac (NUGET):
Affected version(s) >=2.0.0-rc1 <=2.5.5
Fix Suggestion:
Update to version no_fix
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Insertion of Sensitive Information into Log File
EPSS
Base Score:
0.06