CVE-2024-31216

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31216", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-29T14:16:31.901Z", "datePublished": "2024-05-15T15:52:15.084Z", "dateUpdated": "2024-08-02T01:46:04.808Z"}, "containers": {"cna": {"title": "source-controller leaks theAzure Storage SAS token into logs on connection errors", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w"}, {"name": "https://github.com/fluxcd/source-controller/pull/1430", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluxcd/source-controller/pull/1430"}, {"name": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9"}], "affected": [{"vendor": "fluxcd", "product": "source-controller", "versions": [{"version": "< 1.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-15T15:52:15.084Z"}, "descriptions": [{"lang": "en", "value": "The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity."}], "source": {"advisory": "GHSA-v554-xwgw-hc3w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-16T17:32:05.849081Z", "id": "CVE-2024-31216", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T18:16:00.378Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.808Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w"}, {"name": "https://github.com/fluxcd/source-controller/pull/1430", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fluxcd/source-controller/pull/1430"}, {"name": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31216", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-16T17:32:05.849081Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-16T17:31:40.521Z"}}], "cna": {"title": "source-controller leaks theAzure Storage SAS token into logs on connection errors", "source": {"advisory": "GHSA-v554-xwgw-hc3w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "fluxcd", "product": "source-controller", "versions": [{"status": "affected", "version": "< 1.2.5"}]}], "references": [{"url": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w", "name": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fluxcd/source-controller/pull/1430", "name": "https://github.com/fluxcd/source-controller/pull/1430", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9", "name": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-15T15:52:15.084Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31216", "state": "PUBLISHED", "dateUpdated": "2024-07-24T18:16:00.378Z", "dateReserved": "2024-03-29T14:16:31.901Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-15T15:52:15.084Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "source-controller", "vendor": "fluxcd", "versions": [{"status": "affected", "version": "< 1.2.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity."}, {"lang": "es", "value": "El controlador de fuente es un operador de Kubernetes, especializado en la adquisici\u00f3n de artefactos de fuentes externas como Git, OCI, repositorios Helm y dep\u00f3sitos compatibles con S3. El controlador de fuente implementa la API source.toolkit.fluxcd.io y es un componente central del kit de herramientas GitOps. Antes de la versi\u00f3n 1.2.5, cuando el controlador de origen se configuraba para usar un token SAS de Azure al conectarse a Azure Blob Storage, el token se registraba junto con la direcci\u00f3n URL de Azure cuando el controlador encontraba un error de conexi\u00f3n. Un atacante con acceso a los registros del controlador de origen podr\u00eda usar el token para obtener acceso a Azure Blob Storage hasta que caduque el token. Esta vulnerabilidad se solucion\u00f3 en el controlador de fuente v1.2.5. No existe ninguna soluci\u00f3n para esta vulnerabilidad excepto el uso de un mecanismo de autenticaci\u00f3n diferente, como Azure Workload Identity."}], "id": "CVE-2024-31216", "lastModified": "2026-06-17T07:28:00.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-31216", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-16T17:32:05.849081Z", "version": "2.0.3"}}]}, "published": "2024-05-15T16:15:10.097", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9"}, {"source": "security-advisories@github.com", "url": "https://github.com/fluxcd/source-controller/pull/1430"}, {"source": "security-advisories@github.com", "url": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/fluxcd/source-controller/pull/1430"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T22:09:21.699884+00:00", "updated": "2025-07-12T22:09:21.699941+00:00", "vendors": ["fluxcd", "fluxcd$PRODUCT$source-controller"]}