CVE-2020-5262: EasyBuild Framework GitHub Personal Access Token Disclosure
Summary
CVE-2020-5262: In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like --new-pr, --fro,-pr, etc.) is shown in plain text in EasyBuild debug log files. Affects easybuild-framework versions < 4.1.2. Fixed in 4.1.2. How to fix ↓
Also tracked for
- easybuild · PyPI
The same CVE-2020-5262 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
EasyBuild is a software build and installation framework that allows users to easily build and install scientific software packages. It provides a simple interface for managing software dependencies and automates the process of building and installing software. The GitHub integration features in EasyBuild allow users to create and manage pull requests directly from the command line. These features require the use of a GitHub Personal Access Token (PAT) for authentication.
Vulnerability Detail
The vulnerability in EasyBuild before version 4.1.2 allows the GitHub PAT used for GitHub integration features to be exposed in plain text in EasyBuild debug log files. This means that anyone with access to these log files can obtain the PAT, which can potentially lead to unauthorized access to GitHub repositories and other related actions. The issue has been fixed in EasyBuild v4.1.2 and in the master and develop branches of the easybuild-framework repository.
How To Fix
Minimum fixed version
4.1.2
This is the first release that contains the fix.
pip install --upgrade "easybuild-framework==4.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The vulnerability in EasyBuild Framework allows the GitHub Personal Access Token (PAT) to be exposed in debug log files, potentially leading to unauthorized access to GitHub repositories. Users should upgrade to EasyBuild v4.1.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for easybuild-framework →
FAQ
EasyBuild is a software build and installation framework for scientific software packages.
The GitHub integration features in EasyBuild allow users to create and manage pull requests directly from the command line.
A GitHub Personal Access Token (PAT) is a token that provides authentication for accessing GitHub repositories and performing related actions.
The GitHub PAT is exposed in plain text in EasyBuild debug log files, allowing anyone with access to these log files to obtain the token.
To fix this vulnerability, upgrade to EasyBuild v4.1.2 or later.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
