Vulnerabilities > CVE-2024-23840 - Unspecified vulnerability in Goreleaser 1.23.0

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
local
low complexity
goreleaser
NVD
Published: 2024-01-30
Updated: 2024-11-21

Summary

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

Vulnerable Configurations

Part Description Count
Application
Goreleaser
1

References