#auth

### Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output ### Details There was a handful of instances where the `apko` tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The`%s` verb was used to format a `url.URL` as a string, which includes un-redacted HTTP basic authentication credentials if they are included in the URL. 2. A string URL value (such as from the configuration YAML file supplied used in an apko execution) was never parsed as a URL, so there was no chance of redacting credentials in the logical flow. apko, as well as its companion library `go-apk`, have been updated to ensure URLs are parsed and redacted before being output as string values. ### PoC Create a config file like this `apko.yaml`: ```yaml contents: keyring: - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub repositories: - https://me%40example.com:supersecretpass...

Failing to properly encode user input, the CSS styled content component is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.

Progress Software has rolled out updates to address a critical security flaw impacting the Telerik Report Server that could be potentially exploited by a remote attacker to bypass authentication and create rogue administrator users. The issue, tracked as CVE-2024-4358, carries a CVSS score of 9.8 out of a maximum of 10.0. "In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or

Red Hat Security Advisory 2024-3576-03 - New images are available for Red Hat build of Keycloak 24.0.5 and Red Hat build of Keycloak 24.0.5 Operator, running on OpenShift Container Platform.

Red Hat Security Advisory 2024-3575-03 - An update is now available for Red Hat build of Keycloak.

Red Hat Security Advisory 2024-3574-03 - New Red Hat build of Keycloak 22.0.11 packages are available from the Customer Portal.

Red Hat Security Advisory 2024-3573-03 - New images are available for Red Hat build of Keycloak 22.0.11 and Red Hat build of Keycloak 22.0.11 Operator, running on OpenShift Container Platform.

Red Hat Security Advisory 2024-3572-03 - A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal.

Red Hat Security Advisory 2024-3570-03 - A new image is available for Red Hat Single Sign-On 7.6.9, running on OpenShift Container Platform 3.10 and 3.11, and 4.3.

Red Hat Security Advisory 2024-3568-03 - New Red Hat Single Sign-On 7.6.9 package are now available for Red Hat Enterprise Linux 9.