modules:
  - module: github.com/bradleyfalzon/ghinstallation
    versions:
      - fixed: 1.1.2-0.20210308182858-d24f14f8be70
    vulnerable_at: 1.1.1
    packages:
      - package: github.com/bradleyfalzon/ghinstallation
        symbols:
          - Transport.refreshToken
          - Transport.Token
        derived_symbols:
          - Transport.RoundTrip
description: |
    Errors returned by ghinstallation.Transport can include the JWT used for
    the failed operation. If the error is exposed to an untrusted party, this
    JWT could be extracted and used to authenticate further requests.
cves:
  - CVE-2022-39304
ghsas:
  - GHSA-h4q8-96p6-jcgr
credit: '@Miskerest'
references:
  - advisory: https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgr
  - fix: https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3e
  - web: https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation