modules:
  - module: go.elastic.co/apm
    versions:
      - fixed: 1.11.0
    vulnerable_at: 1.10.0
    packages:
      - package: go.elastic.co/apm
        symbols:
          - modelWriter.buildModelTransaction
        derived_symbols:
          - NewTracer
          - NewTracerOptions
description: |
    Sensitive HTTP headers may not be properly sanitized before being sent to the
    APM server if the program panics.
published: 2021-05-18T18:34:18Z
cves:
  - CVE-2021-22133
ghsas:
  - GHSA-qqc5-rgcc-cjqh
references:
  - fix: https://github.com/elastic/apm-agent-go/pull/888
  - fix: https://github.com/elastic/apm-agent-go/commit/dd3e8c593580e7b80a98b57e1cc6e017e56747b4