Skip to content
Fencer Vulns
medium 6.0

CVE-2024-6104 json

go-retryablehttp can leak basic auth credentials to log files

published 2024-06-24 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2173 , GHSA-v6v8-xj6m-xwqh , GO-2024-2947

cvss
6.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Patch / fix

  • go github.com/hashicorp/go-retryablehttp 0.7.7
  • HashiCorp Shared library 0.7.7
  • openshift-pipelines-client openshift pipelines 1.16 1.16.0-11647.el8
  • openshift-pipelines-client-redistributable openshift pipelines 1.16 1.16.0-11647.el8
  • grafana RHEL 9 10.2.6-4.el9
  • grafana-selinux RHEL 9 10.2.6-4.el9
  • skopeo RHEL 9 2:1.16.1-1.el9
  • skopeo-tests RHEL 9 2:1.16.1-1.el9
  • crit RHEL 8 3.18-5.module+el8.10.0+22202+761b9a65
  • criu RHEL 8 3.18-5.module+el8.10.0+22202+761b9a65

red hat advisories RHEA-2024:7866RHSA-2024:9115RHSA-2024:9098RHSA-2024:5258RHSA-2024:5194RHSA-2024:5446

  • podman Linux Micro 6.0 4.9.5-12.1
  • podman Linux Micro 6.0 4.9.5-8.1
  • podman SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Module for Containers 15 SP7 +5 more 4.9.5-150500.3.43.2
  • podman SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 4.9.5-150300.9.49.2
  • podman SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 4.9.5-150400.4.47.2
  • skopeo Linux Micro 6.1 1.15.1-slfo.1.1_2.1
  • podman Linux Micro 6.0 4.9.5-4.1
  • cosign SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +9 more 2.5.0-150400.3.27.1

suse advisories SUSE-SU-2026:22516-1SUSE-SU-2025:20869-1SUSE-RU-2025:02093-1SUSE-RU-2025:02092-1SUSE-RU-2025:02091-1SUSE-SU-2025:20363-1

  • glab openSUSE Leap 16.0 1.114.0-bp160.1.1
  • grafana openSUSE Tumbleweed 11.5.4-1.1
  • cosign openSUSE Tumbleweed 2.5.0-1.1
  • rekor openSUSE Tumbleweed 1.3.10-1.1
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git142.862ef23-1.1
  • traefik openSUSE Tumbleweed 3.1.2-1.1
  • traefik2 openSUSE Tumbleweed 2.11.8-1.1
  • gh Package Hub 15 SP5, openSUSE Leap 15.5 2.53.0-bp155.2.12.1

opensuse advisories openSUSE-SU-2026:21662-1openSUSE-SU-2025:15052-1openSUSE-SU-2025:14988-1openSUSE-SU-2025:14990-1openSUSE-SU-2025:14663-1openSUSE-SU-2024:14257-1

  • skopeo AlmaLinux 9 2:1.16.1-1.el9
  • skopeo-tests AlmaLinux 9 2:1.16.1-1.el9
  • grafana AlmaLinux 9 10.2.6-4.el9
  • grafana-selinux AlmaLinux 9 10.2.6-4.el9
  • podman AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-tests AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-docker AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-remote AlmaLinux 9 4:4.9.4-10.el9_4

almalinux advisories ALSA-2024:9098ALSA-2024:9115ALSA-2024:6194ALSA-2024:5258

  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-4.module+el8.10.0+1843+6892ab28
  • udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
  • conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
  • podman Rocky Linux 8 4:4.9.4-12.module+el8.10.0+1843+6892ab28
  • skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28
  • buildah Rocky Linux 8 2:1.33.8-4.module+el8.10.0+1843+6892ab28

rocky linux advisories RLSA-2024:5258

  • packer CBL-Mariner 2.0, Azure Linux 3.0 1.9.5-2
  • skopeo Azure Linux 3.0 1.14.4-2
  • cert-manager Azure Linux 3.0 1.12.12-3
  • influxdb Azure Linux 3.0 2.7.3-5
  • libcontainers-common Azure Linux 3.0 20240213-2
  • prometheus Azure Linux 3.0 2.45.4-3
  • keda Azure Linux 3.0 2.14.0-2
  • skopeo CBL-Mariner 2.0 1.14.2-7

azure linux advisories AZL-42874AZL-42877AZL-42880AZL-42886AZL-42892AZL-42898

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-6104 updated cvss 6.0

go-retryablehttp: url might write sensitive information to log file

  • Red Hat OpenShift API for Data Protection oadp/oadp-kubevirt-velero-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-clients
    affected: workaround, no fix available
  • Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 9 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat OpenShift AI (RHOAI) odh-ml-pipelines-driver-container
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 prometheus-promu, openshift4/ose-console, openshift-prometheus-promu, openshift4/ose-contour-rhel8, golang-github-prometheus-promu, openshift4/ose-powervs-machine-controllers-rhel8, +1 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8
    affected: workaround, no fix planned “Will not fix”
show 30 more
  • Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator, openshift-sandboxed-containers/osc-podvm-payload-rhel9
    affected: workaround, no fix available
  • Red Hat cert-manager operator for Red Hat OpenShift 1.14 cert-manager v1.14.7-1743759417
    fixed: vendor fix RHSA-2025:3714
  • Red Hat cert-manager operator for Red Hat OpenShift 1.15 cert-manager
    fixed: vendor fix RHSA-2025:0536
  • Red Hat COO 0.4 for RHEL 8 cluster-observability-operator/coo-thanos-rhel8 v0.36.1-1, cluster-observability-operator/coo-korrel8r-rhel8 v0.6.3-15, cluster-observability-operator/coo-prometheus-rhel8 v2.54.1-1, cluster-observability-operator/coo-admission-webhook-rhel8 v0.77.1-1, cluster-observability-operator/coo-prometheus-rhel8-operator v0.77.1-1, cluster-observability-operator/coo-console-logging-plugin-rhel8 v6.0.0-20, +7 more
    fixed: vendor fix RHSA-2024:8040
  • Red Hat multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/hive-rhel8 v2.5.7-1
    fixed: vendor fix RHSA-2024:6738
  • Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 2.14.1-454, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8 2.14.1-454, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator 2.14.1-454, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle 2.14.1-454, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8 2.14.1-454
    fixed: vendor fix RHBA-2024:5865
  • Red Hat OpenShift Pipelines version 1.16 for RHEL 8 openshift-pipelines-client 1.16.0-11647.el8, openshift-pipelines-client-redistributable 1.16.0-11647.el8
    fixed: vendor fix RHEA-2024:7866
  • Red Hat Ceph Storage 8.1 Tools rhceph/rhceph-8-rhel9 8-492, rhceph/grafana-rhel9 11.5.2-6, rhceph/keepalived-rhel9 2.2.8-65, rhceph/oauth2-proxy-rhel9 v7.6.0-27, rhceph/snmp-notifier-rhel9 1.2.1-115, rhceph/rhceph-haproxy-rhel9 2.4.22-67, +1 more
    fixed: vendor fix RHSA-2025:9776
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22202+761b9a65, criu 3.18-5.module+el8.10.0+22202+761b9a65, crun 1.14.3-2.module+el8.10.0+22202+761b9a65, runc 1.1.12-4.module+el8.10.0+22202+761b9a65, udica 0.2.6-21.module+el8.10.0+22202+761b9a65, conmon 2.1.10-1.module+el8.10.0+22202+761b9a65, +27 more
    fixed: vendor fix RHSA-2024:5258
  • Red Hat Enterprise Linux AppStream (v. 9) skopeo 1.16.1-1.el9, grafana 10.2.6-4.el9, podman 4.9.4-10.el9_4, skopeo-tests 1.16.1-1.el9, podman-tests 4.9.4-10.el9_4, grafana-selinux 10.2.6-4.el9, +3 more
    fixed: vendor fix RHSA-2024:6194
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) crit 3.15-4.module+el8.8.0+22142+4cbed6b3, criu 3.15-4.module+el8.8.0+22142+4cbed6b3, crun 1.8.4-2.module+el8.8.0+22142+4cbed6b3, runc 1.1.12-1.module+el8.8.0+22142+4cbed6b3, conmon 2.1.6-1.module+el8.8.0+22142+4cbed6b3, udica 0.2.6-20.module+el8.8.0+22142+4cbed6b3, +27 more
    fixed: vendor fix RHSA-2024:5194
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) podman 4.4.1-20.el9_2, podman-tests 4.4.1-20.el9_2, podman-docker 4.4.1-20.el9_2, podman-remote 4.4.1-20.el9_2, podman-gvproxy 4.4.1-20.el9_2, podman-plugins 4.4.1-20.el9_2
    fixed: vendor fix RHSA-2024:5634
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-installer v4.12.0-202409040731.p0.g798aeaa.assembly.stream.el8, openshift4/ose-sriov-network-webhook v4.12.0-202408091241.p0.g83b800f.assembly.stream.el8, openshift4/ose-cloud-credential-operator v4.12.0-202408072203.p0.g6de9c4e.assembly.stream.el8, openshift4/ose-ibm-vpc-block-csi-driver-rhel8 v4.12.0-202408071159.p0.g921509f.assembly.stream.el8, openshift4/ose-cluster-image-registry-operator v4.12.0-202408071159.p0.g77fd1a9.assembly.stream.el8, openshift4/ose-azure-cluster-api-controllers-rhel8 v4.12.0-202408220304.p0.ga1b2a37.assembly.stream.el8, +1 more
    fixed: vendor fix RHSA-2024:5808
  • Red Hat OpenShift Container Platform 4.13 podman 4.4.1-12.rhaos4.13.el8, podman 4.4.1-13.rhaos4.13.el9, podman-tests 4.4.1-12.rhaos4.13.el8, podman-tests 4.4.1-13.rhaos4.13.el9, podman-docker 4.4.1-12.rhaos4.13.el8, podman-docker 4.4.1-13.rhaos4.13.el9, +17 more
    fixed: vendor fix RHSA-2024:5444
  • Red Hat OpenShift Container Platform 4.14 podman 4.4.1-16.4.rhaos4.14.el8, podman 4.4.1-16.4.rhaos4.14.el9, podman-tests 4.4.1-16.4.rhaos4.14.el8, podman-tests 4.4.1-16.4.rhaos4.14.el9, podman-docker 4.4.1-16.4.rhaos4.14.el8, podman-docker 4.4.1-16.4.rhaos4.14.el9, +18 more
    fixed: vendor fix RHSA-2024:5433
  • Red Hat OpenShift Container Platform 4.15 podman 4.4.1-26.2.rhaos4.15.el8, podman 4.4.1-26.2.rhaos4.15.el9, podman-tests 4.4.1-26.2.rhaos4.15.el8, podman-tests 4.4.1-26.2.rhaos4.15.el9, podman-docker 4.4.1-26.2.rhaos4.15.el8, podman-docker 4.4.1-26.2.rhaos4.15.el9, +17 more
    fixed: vendor fix RHSA-2024:4699
  • Red Hat OpenShift Container Platform 4.16 podman 4.9.4-8.rhaos4.16.el8, podman 4.9.4-9.rhaos4.16.el9, podman-tests 4.9.4-8.rhaos4.16.el8, podman-tests 4.9.4-9.rhaos4.16.el9, podman-docker 4.9.4-8.rhaos4.16.el8, podman-docker 4.9.4-9.rhaos4.16.el9, +17 more
    fixed: vendor fix RHSA-2024:4858
  • Red Hat OpenShift Container Platform 4.17 podman 5.2.0-2.rhaos4.17.el9, podman 5.2.0-3.rhaos4.17.el8, skopeo 1.16.0-2.rhaos4.17.el8, skopeo 1.16.0-2.rhaos4.17.el9, podman-tests 5.2.0-2.rhaos4.17.el9, podman-tests 5.2.0-3.rhaos4.17.el8, +11 more
    fixed: vendor fix RHSA-2024:3722
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-cluster-ingress-rhel9-operator v4.18.0-202501230001.p0.g8be1749.assembly.stream.el9
    fixed: vendor fix RHSA-2024:6122
  • Red Hat OpenShift GitOps 1.12 openshift-gitops-1/dex-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel9 v1.12.6-1, openshift-gitops-1/gitops-rhel8 v1.12.6-2, openshift-gitops-1/must-gather-rhel8 v1.12.6-2, openshift-gitops-1/kam-delivery-rhel8 v1.12.6-2, +4 more
    fixed: vendor fix RHSA-2024:8677
  • Red Hat OpenShift Serverless 1.33 openshift-serverless-1/client-kn-rhel8 1.12.0-6, openshift-serverless-1/func-utils-rhel8 1.33.1-1, openshift-serverless-1/serving-queue-rhel8 1.12.0-5, openshift-serverless-1/eventing-mtping-rhel8 1.12.0-7, openshift-serverless-1/kourier-control-rhel8 1.12.0-5, openshift-serverless-1/serving-webhook-rhel8 1.12.0-5, +30 more
    fixed: vendor fix RHSA-2024:4872
  • Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.5-4, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.5-2, advanced-cluster-security/rhacs-scanner-rhel8 4.4.5-2, advanced-cluster-security/rhacs-rhel8-operator 4.4.5-2, advanced-cluster-security/rhacs-collector-rhel8 4.4.5-2, advanced-cluster-security/rhacs-operator-bundle 4.4.5-3, +7 more
    fixed: vendor fix RHSA-2024:6054
  • Red Hat RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9 v4.13.12-2
    fixed: vendor fix RHSA-2024:7744
  • Red Hat RHODF 4.14 for RHEL 9 odf4/cephcsi-rhel9 v4.14.11-2, odf4/ocs-rhel9-operator v4.14.16-2, odf4/odf-rhel9-operator v4.14.16-2
    fixed: vendor fix RHSA-2024:7624
  • Red Hat RHODF 4.15 for RHEL 9 odf4/ocs-rhel9-operator v4.15.12-1, odf4/odf-rhel9-operator v4.15.12-1
    fixed: vendor fix RHSA-2025:1865
  • Red Hat RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9 v4.16.2-2, odf4/odf-cli-rhel9 v4.16.1-3, odf4/odf-cli-rhel9 v4.16.2-2, odf4/mcg-rhel9-operator v4.16.1-3, odf4/ocs-rhel9-operator v4.16.8-1, odf4/odf-rhel9-operator v4.16.8-1, +2 more
    fixed: vendor fix RHSA-2024:6755
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/kibana6-rhel8 v6.8.1-460, openshift-logging/vector-rhel8 v0.21.0-138, openshift-logging/fluentd-rhel8 v1.14.6-228, openshift-logging/eventrouter-rhel8 v0.4.0-300, openshift-logging/logging-loki-rhel8 v3.1.1-11, openshift-logging/loki-rhel8-operator v5.6.24-7, +12 more
    fixed: vendor fix RHSA-2024:7323
  • Red Hat RHOL 5.8 for RHEL 9 openshift-logging/fluentd-rhel9 v5.8.13-3, openshift-logging/vector-rhel9 v0.28.1-76, openshift-logging/logging-loki-rhel9 v3.1.1-7, openshift-logging/eventrouter-rhel9 v0.4.0-296, openshift-logging/loki-rhel9-operator v5.8.13-6, openshift-logging/opa-openshift-rhel9 v0.1.0-284, +11 more
    fixed: vendor fix RHSA-2024:7237
  • Red Hat RHOL 5.9 for RHEL 9 openshift-logging/fluentd-rhel9 v5.9.7-3, openshift-logging/vector-rhel9 v0.34.1-19, openshift-logging/eventrouter-rhel9 v0.4.0-301, openshift-logging/logging-loki-rhel9 v3.1.1-10, openshift-logging/loki-rhel9-operator v5.9.7-7, openshift-logging/loki-operator-bundle v5.9.7-16, +6 more
    fixed: vendor fix RHSA-2024:7324
  • Red Hat RHOL 6.0 for RHEL 9 openshift-logging/logging-loki-rhel9 v3.2.0-12
    fixed: vendor fix RHSA-2024:8314

23 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
GitHub 3.1 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/hashicorp/go-retryablehttp
<0.7.7
0.7.7

Affected products

  • HashiCorp Shared library

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.