GHSA-qqhq-8r2c-c3f5: Dependency check ant NvdApiKey Is Logged Vulnerability
LOWGHSA-qqhq-8r2c-c3f5 is a LOW (CVSS 3.3) nvdapikey is logged vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Dependency check ant libraries in the Maven ecosystem. The issue involves nvdapikey is logged in debug mode. Remediation is available by upgrading affected packages to version 9.0.6.
GHSA-qqhq-8r2c-c3f5 at a Glance
Security Impact
CVSS: 3.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
How to Fix GHSA-qqhq-8r2c-c3f5
To remediate this vulnerability, upgrade all affected Dependency check ant dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-ant</artifactId>
<version>9.0.6</version>
</dependency><dependency>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-cli</artifactId>
<version>9.0.6</version>
</dependency><dependency>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>9.0.6</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.owaspHow to Check if You Are Affected
To determine whether your Java application is affected by GHSA-qqhq-8r2c-c3f5, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.owaspAnalyze the terminal output to locate any version of Dependency check ant in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 9.0.6), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.owasp command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Dependency check ant, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-qqhq-8r2c-c3f5 Affected Dependency check ant Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.owasp:dependency-check-ant
|
Maven |
≥ 9.0.0
< 9.0.6
|
9.0.6
|
|
org.owasp:dependency-check-cli
|
Maven |
≥ 9.0.0
< 9.0.6
|
9.0.6
|
|
org.owasp:dependency-check-maven
|
Maven |
≥ 9.0.0
< 9.0.6
|
9.0.6
|
References
Frequently Asked Questions
What is GHSA-qqhq-8r2c-c3f5?
Which Dependency check ant versions are affected?
What version fixes GHSA-qqhq-8r2c-c3f5?
Is dependency-check-ant affected?
Is dependency-check-cli affected?
What is the CVSS score of GHSA-qqhq-8r2c-c3f5?
What CWE is associated with GHSA-qqhq-8r2c-c3f5?
How can I check Maven dependencies for GHSA-qqhq-8r2c-c3f5?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-qqhq-8r2c-c3f5",
"modified" : "2023-12-16T00:51:51Z",
"published" : "2023-12-15T23:43:30Z",
"aliases" : [ ],
"summary" : "nvdApiKey is logged in debug mode",
"details" : "### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.owasp:dependency-check-ant"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "9.0.0"
}, {
"fixed" : "9.0.6"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 9.0.5"
}
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "org.owasp:dependency-check-cli"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "9.0.0"
}, {
"fixed" : "9.0.6"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 9.0.5"
}
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "org.owasp:dependency-check-maven"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "9.0.0"
}, {
"fixed" : "9.0.6"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/jeremylong/DependencyCheck"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-532" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2023-12-15T23:43:30Z",
"nvd_published_at" : null
}
}